PT-2018-3225 · Php+5 · Php+5

Published

2018-01-08

·

Updated

2020-04-08

·

CVE-2018-5712

CVSS v2.0

6.4

Medium

VectorAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.33 PHP versions 7.0.x prior to 7.0.27 PHP versions 7.1.x prior to 7.1.13 PHP versions 7.2.x prior to 7.2.1
Description The issue is related to Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file. This occurs due to insufficient protection measures for the web page structure, allowing a remote attacker to perform cross-site scripting attacks.
Recommendations For PHP versions prior to 5.6.33, update to version 5.6.33 or later. For PHP versions 7.0.x prior to 7.0.27, update to version 7.0.27 or later. For PHP versions 7.1.x prior to 7.1.13, update to version 7.1.13 or later. For PHP versions 7.2.x prior to 7.2.1, update to version 7.2.1 or later.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2018-1123
ALT-PU-2018-1138
BDU:2019-04386
CESA-2020_1112
CVE-2018-5712
DLA-1251-1
DLA-1397-1
DSA-4080-1
DSA-4081-1
DSA-4240-1
RHSA-2018:1296
RHSA-2019:2519
RHSA-2020:1112
RHSA-2020_1112
SUSE-SU-2018:0216-1
SUSE-SU-2018:0308-1
SUSE-SU-2018:0806-1
USN-3566-1
USN-3600-1
USN-3600-2

Affected Products

Alt Linux
Centos
Php
Red Hat
Suse
Ubuntu