NetSight
IP …
medium6.1

CVE-2018-10547

An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5.

Impact

An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.

Affected products

VendorProductAffected versions
PhpPhp
before 5.6.36
from 7.0.0 before 7.0.30
from 7.1.0 before 7.1.17
from 7.2.0 before 7.2.5
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 17.10, 18.04
DebianDebian Linux
Versions 7.0, 8.0, 9.0
NetappStorage Automation Store
All versions

Weakness classification

CWE-79

References