CVE-2018-5712
Published: 16 January 2018
An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
php5 Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
| bionic |
Does not exist
|
|
| trusty |
Released
(5.5.9+dfsg-1ubuntu4.23)
|
|
| upstream |
Released
(5.6.33)
|
|
| xenial |
Does not exist
|
|
|
Patches: upstream: http://git.php.net/?p=php-src.git;a=commit;h=73ca9b37731dd9690ffd9706333b17eaf90ea091 |
||
|
php7.0 Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
| bionic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(7.0.27)
|
|
| xenial |
Released
(7.0.28-0ubuntu0.16.04.1)
|
|
|
php7.1 Launchpad, Ubuntu, Debian |
artful |
Released
(7.1.15-0ubuntu0.17.10.1)
|
| bionic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(7.1.13)
|
|
| xenial |
Does not exist
|
|
|
php7.2 Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
| bionic |
Not vulnerable
(7.2.2-1ubuntu2)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(7.2.1)
|
|
| xenial |
Does not exist
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.1 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |