CVE Vulnerability

CVE-2018-5712

An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://bugs.php.net/bug.php?id=74782 Issue Tracking Patch
http://php.net/ChangeLog-7.php Release Notes Vendor Advisory
http://php.net/ChangeLog-5.php Release Notes Vendor Advisory
http://www.securityfocus.com/bid/102742 Third Party Advisory VDB Entry
https://lists.debian.org/debian-lts-announce/2018/01/msg00025.html Mailing List Third Party Advisory
http://www.securitytracker.com/id/1040363 Third Party Advisory VDB Entry
https://usn.ubuntu.com/3566-1/ Third Party Advisory
https://usn.ubuntu.com/3600-1/ Third Party Advisory
http://www.securityfocus.com/bid/104020 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:1296 Third Party Advisory
https://usn.ubuntu.com/3600-2/ Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2519
https://www.oracle.com/security-alerts/cpuapr2020.html
Configurations

Configuration 1

cpe:2.3:a:php:php:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
Information

Published : 2018-01-16 09:29

Updated : 2019-08-19 11:15

NVD link : CVE-2018-5712

Mitre link : CVE-2018-5712

Products Affected
No products.
CWE
CWE-79