CVE-2021-21707 in Communications User Data Repository

Summary

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Responsible

PHP Group

Reservation

01/04/2021

Disclosure

11/29/2021

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
211482	Oracle Communications User Data Repository Platform information disclosure	200	Not defined	Official fix	CVE-2021-21707
187290	PHP XML Parser simplexml_load_file null termination	170	Not defined	Official fix	CVE-2021-21707

Sources

• MITRE
• NVD
• CVE Details