CVE-2018-17082MEDIUM
Description
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
References
http://php.net/ChangeLog-5.php
http://php.net/ChangeLog-7.php
https://access.redhat.com/errata/RHSA-2019:2519
https://bugs.php.net/bug.php?id=76582
https://github.com/php/php-src/commit/23b057742e3cf199612fa8050ae86cae675e214e
https://lists.debian.org/debian-lts-announce/2018/09/msg00020.html
https://security.gentoo.org/glsa/201812-01
https://security.netapp.com/advisory/ntap-20180924-0001/
Details
Source: MITRE
Published: 2018-09-16
Updated: 2019-08-19
Type: CWE-79
Risk Information
CVSS v2.0
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3.0
Base Score: 6.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Impact Score: 2.7
Exploitability Score: 2.8
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Configuration 2
OR
Configuration 3
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 137966 | EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747) | Nessus | Huawei Local Security Checks | critical |
| 132184 | EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649) | Nessus | Huawei Local Security Checks | critical |
| 131592 | EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438) | Nessus | Huawei Local Security Checks | critical |
| 129178 | EulerOS 2.0 SP5 : php (EulerOS-SA-2019-1984) | Nessus | Huawei Local Security Checks | high |
| 123331 | openSUSE Security Update : php7 (openSUSE-2019-771) | Nessus | SuSE Local Security Checks | medium |
| 98872 | PHP 7.2.x < 7.2.10 Transfer-Encoding Parameter XSS Vulnerability | Web Application Scanning | Component Vulnerability | medium |
| 98871 | PHP 7.1.x < 7.1.22 Transfer-Encoding Parameter XSS Vulnerability | Web Application Scanning | Component Vulnerability | medium |
| 98870 | PHP 7.0.x < 7.0.32 Transfer-Encoding Parameter XSS Vulnerability | Web Application Scanning | Component Vulnerability | medium |
| 98869 | PHP 5.6.x < 5.6.38 Transfer-Encoding Parameter XSS Vulnerability | Web Application Scanning | Component Vulnerability | medium |
| 120726 | Fedora 28 : php (2018-b6072889db) | Nessus | Fedora Local Security Checks | medium |
| 120547 | Fedora 29 : php (2018-791c3cfe21) | Nessus | Fedora Local Security Checks | medium |
| 120121 | SUSE SLES12 Security Update : php5 (SUSE-SU-2018:3017-1) | Nessus | SuSE Local Security Checks | medium |
| 120120 | SUSE SLES15 Security Update : php7 (SUSE-SU-2018:3016-1) | Nessus | SuSE Local Security Checks | medium |
| 120107 | SUSE SLES12 Security Update : php7 (SUSE-SU-2018:2887-1) | Nessus | SuSE Local Security Checks | medium |
| 119561 | Debian DSA-4353-1 : php7.0 - security update | Nessus | Debian Local Security Checks | high |
| 119320 | GLSA-201812-01 : PHP: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | medium |
| 118210 | Amazon Linux AMI : php56 / php70,php71,php72 (ALAS-2018-1090) | Nessus | Amazon Linux Local Security Checks | medium |
| 117989 | SUSE SLES11 Security Update : php53 (SUSE-SU-2018:3018-1) | Nessus | SuSE Local Security Checks | medium |
| 117985 | openSUSE Security Update : php7 (openSUSE-2018-1131) | Nessus | SuSE Local Security Checks | medium |
| 117984 | openSUSE Security Update : php5 (openSUSE-2018-1130) | Nessus | SuSE Local Security Checks | medium |
| 117853 | openSUSE Security Update : php7 (openSUSE-2018-1078) | Nessus | SuSE Local Security Checks | medium |
| 117646 | Fedora 27 : php (2018-25100b492c) | Nessus | Fedora Local Security Checks | medium |
| 117610 | Debian DLA-1509-1 : php5 security update | Nessus | Debian Local Security Checks | medium |
| 117500 | PHP 7.2.x < 7.2.10 Transfer-Encoding Parameter XSS Vulnerability | Nessus | CGI abuses | medium |
| 117499 | PHP 7.1.x < 7.1.22 Transfer-Encoding Parameter XSS Vulnerability | Nessus | CGI abuses | medium |
| 117498 | PHP 7.0.x < 7.0.32 Transfer-Encoding Parameter XSS Vulnerability | Nessus | CGI abuses | medium |
| 117497 | PHP 5.6.x < 5.6.38 Transfer-Encoding Parameter XSS Vulnerability | Nessus | CGI abuses | medium |