How severe is CVE-2020-7063?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.3 out of 10.

What type of vulnerability is CVE-2020-7063?

This is classified as CWE-281, which is a common weakness in software security.

CVE-2020-7063 - MEDIUM Severity | CVSS 5.3

Vulnerability Description

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.

Related Vulnerabilities

CVE-2020-8633

MEDIUM

CVSS:5.3(Medium)

An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible.

CWE-2812020

CVE-2020-9781

MEDIUM

CVSS:5.3(Medium)

The issue was addressed by clearing website permission prompts after navigation. This issue is fixed in iOS 13.4 and iPadOS 13.4. A user may grant website permissions to a site they didn't intend to.

CWE-2812020

CVE-2021-37056

MEDIUM

CVSS:5.3(Medium)

There is an Improper permission control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts to obtain certain device information.

CWE-2812021

CVE-2021-39897

MEDIUM

CVSS:5.3(Medium)

Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferr...

CWE-2812021

CVE-2022-47547

MEDIUM

CVSS:5.3(Medium)

GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.

CWE-2812022

CVE-2022-48296

MEDIUM

CVSS:5.3(Medium)

The SystemUI has a vulnerability in permission management. Successful exploitation of this vulnerability may cause users to receive broadcasts from malicious apps, conveying false alarm information ab...

CWE-2812022