CVE-2018-5712

MEDIUM severity · CVSS 6.1 · Cross-site scripting (XSS)

6.1CVSS MEDIUM

Summary

An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactLow

Integrity impactLow

Availability impactNone

Exploit probability (EPSS)89%

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products we track (2)

PHP Ubuntu

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: https://bugs.php.net/bug.php?id=74782 ↗

Additional information

NVD record
https://bugs.php.net/bug.php?id=74782Patch
http://php.net/ChangeLog-5.phpAdvisory
http://php.net/ChangeLog-7.phpAdvisory
http://www.securityfocus.com/bid/102742Advisory
http://www.securityfocus.com/bid/104020Advisory
http://www.securitytracker.com/id/1040363Advisory
https://access.redhat.com/errata/RHSA-2018:1296Advisory
https://access.redhat.com/errata/RHSA-2019:2519