CVE-2018-5712

medium

Description

An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.

References

Advisories
More

https://usn.ubuntu.com/3600-2/

https://usn.ubuntu.com/3600-1/

https://usn.ubuntu.com/3566-1/

https://lists.debian.org/debian-lts-announce/2018/01/msg00025.html

https://access.redhat.com/errata/RHSA-2019:2519

https://access.redhat.com/errata/RHSA-2018:1296

http://www.securitytracker.com/id/1040363

http://www.securityfocus.com/bid/104020

http://www.securityfocus.com/bid/102742

https://www.oracle.com/security-alerts/cpuapr2020.html

https://bugs.php.net/bug.php?id=74782

http://php.net/ChangeLog-7.php

http://php.net/ChangeLog-5.php

Details

Source: Mitre, NVD

Published: 2018-01-16

Updated: 2024-11-21

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N