CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2019-10-28
PHP-FPM Remote Code Execution Vulnerability (CVE-2019-11043) Security Advisory and Mitigation Guide
[Affected Scope] PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11 running in certain Nginx + PHP-FPM configurations
[Impact] Unauthenticated remote attackers can trigger an out-of-bounds memory write in the PHP-FPM process, leading to arbitrary remote code execution (RCE) on the target web server
[Mitigation] Immediately upgrade PHP to patched versions (7.1.33, 7.2.24, 7.3.11 or higher) and configure Nginx with 'try_files' to verify file existence before passing requests to FastCGI