PT-2018-3140 · Php+5 · Php+5

Stefan Cornelius

·

Publicado

2018-04-26

·

Atualizado

2020-04-08

·

CVE-2018-10547

CVSS v2.0

6.4

Média

VetorAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.36 PHP versions 7.0.x prior to 7.0.30 PHP versions 7.1.x prior to 7.1.17 PHP versions 7.2.x prior to 7.2.5
Description The issue is related to Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. This occurs due to an incomplete fix for a previous issue, allowing a remote attacker to perform cross-site scripting attacks.
Recommendations For PHP versions prior to 5.6.36, update to version 5.6.36 or later. For PHP versions 7.0.x prior to 7.0.30, update to version 7.0.30 or later. For PHP versions 7.1.x prior to 7.1.17, update to version 7.1.17 or later. For PHP versions 7.2.x prior to 7.2.5, update to version 7.2.5 or later.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2018-1702
ALT-PU-2018-1704
BDU:2019-04235
CESA-2020_1112
CVE-2018-10547
DLA-1373-1
DLA-1397-1
DSA-4240-1
MGASA-2018-0222
OPENSUSE-SU-2018_1207-1
OPENSUSE-SU-2018_1317-1
RHSA-2019:2519
RHSA-2020:1112
RHSA-2020_1112
SUSE-SU-2018:1176-1
SUSE-SU-2018:1291-1
SUSE-SU-2018:1294-1
USN-3646-1
USN-3646-2

Produtos afetados

Alt Linux
Centos
Php
Red Hat
Suse
Ubuntu