An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php5Upgrade php7 | Oct 1, 2024 | Apr 29, 2018 |
| Amazon_linux | — | Upgrade php56Upgrade php70Upgrade php71 | May 11, 2018 | Apr 29, 2018 |
| Centos_linux | — | Upgrade php-embeddedUpgrade phpUpgrade php-pdoUpgrade php-bcmathUpgrade php-ldapUpgrade php-commonUpgrade php-pgsqlUpgrade php-intlUpgrade php-odbcUpgrade php-soapUpgrade php-fpmUpgrade php-snmpUpgrade php-processUpgrade php-mysqlUpgrade php-pspellUpgrade php-enchantUpgrade php-develUpgrade php-debuginfoUpgrade php-recodeUpgrade php-gdUpgrade php-mbstringUpgrade php-cliUpgrade php-dbaUpgrade php-mysqlndUpgrade php-xmlUpgrade php-xmlrpc | Apr 1, 2020 | Apr 29, 2018 |
| Debian | — | Upgrade php7.0Upgrade php5 | Jul 7, 2018 | Apr 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-mysqlUpgrade php-processUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-cliUpgrade php-recodeUpgrade phpUpgrade php-commonUpgrade php-odbcUpgrade php-soapUpgrade php-pdoUpgrade php-ldapUpgrade php-gdUpgrade php-pgsql | Dec 4, 2019 | Apr 29, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade phpUpgrade php-recodeUpgrade php-commonUpgrade php-ldapUpgrade php-xmlUpgrade php-odbcUpgrade php-cliUpgrade php-mysqlUpgrade php-processUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-gdUpgrade php-soapUpgrade php-pdo | Dec 18, 2019 | Apr 29, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade php-gdUpgrade php-pdoUpgrade php-soapUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-ldapUpgrade php-odbcUpgrade php-mysqlUpgrade php-commonUpgrade php-recodeUpgrade php-xmlUpgrade php-cliUpgrade php-processUpgrade php | Sep 24, 2019 | Apr 29, 2018 |
| Oracle Solaris | — | Upgrade web/php-56 to version 5.6.36-0.175.3.33.0.4.0 on Solaris 11.3Upgrade web/php-71 to version 7.1.17-0.175.3.33.0.4.0 on Solaris 11.3 | Jun 18, 2018 | Apr 29, 2018 |
| Oracle_linux | — | Upgrade php-fpmUpgrade php-xmlUpgrade php-mbstringUpgrade php-commonUpgrade php-develUpgrade php-pspellUpgrade php-processUpgrade php-mysqlUpgrade php-soapUpgrade php-pdoUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-embeddedUpgrade php-odbcUpgrade php-snmpUpgrade php-cliUpgrade php-recodeUpgrade php-dbaUpgrade php-intlUpgrade php-bcmathUpgrade php-ldapUpgrade php-enchantUpgrade php-mysqlndUpgrade phpUpgrade php-gd | Oct 5, 2022 | Apr 26, 2018 |
| Php | — | Upgrade to PHP version 7.2.5Upgrade to PHP version 5.6.36Upgrade to PHP version 7.0.30Upgrade to PHP version 7.1.17 | Jun 8, 2018 | Apr 29, 2018 |
| Redhat_linux | — | No solution existsUpgrade php-xmlUpgrade php-debuginfoUpgrade php-ldapUpgrade php-recodeUpgrade phpUpgrade php-enchantUpgrade php-intlUpgrade php-mysqlndUpgrade php-snmpUpgrade php-embeddedUpgrade php-dbaUpgrade php-gdUpgrade php-cliUpgrade php-xmlrpcUpgrade php-mysqlUpgrade php-fpmUpgrade php-bcmathUpgrade php-pgsqlUpgrade php-soapUpgrade php-pdoUpgrade php-pspellUpgrade php-odbcUpgrade php-develUpgrade php-commonUpgrade php-processUpgrade php-mbstring | Apr 1, 2020 | Apr 29, 2018 |
| Suse | — | Upgrade php53-bz2Upgrade php7-pgsqlUpgrade php7-bcmathUpgrade php7-enchantUpgrade php7-iconvUpgrade php7-curlUpgrade apache2-mod_php5Upgrade php7-snmpUpgrade php53-gettextUpgrade php53-sysvsemUpgrade php53-bcmathUpgrade php53-tokenizerUpgrade php5-opcacheUpgrade php53-ftpUpgrade php7-xmlwriterUpgrade php7-pdoUpgrade php5-bcmathUpgrade php53-fastcgiUpgrade php7-wddxUpgrade php5-opensslUpgrade php5-sysvshmUpgrade php53-pspellUpgrade php53-xmlrpcUpgrade php7-ftpUpgrade php7-fileinfoUpgrade php53-mcryptUpgrade php5-ctypeUpgrade php5-wddxUpgrade php53-gmpUpgrade php53-ldapUpgrade php5-pspellUpgrade php5-fileinfoUpgrade php5-xmlwriterUpgrade php53-soapUpgrade php5-fpmUpgrade php53-intlUpgrade php5-gettextUpgrade php7-pharUpgrade php5-posixUpgrade php5-imapUpgrade php7-sysvsemUpgrade php53-suhosinUpgrade php7-tokenizerUpgrade php7-ctypeUpgrade php53-curlUpgrade apache2-mod_php7Upgrade php7-fpmUpgrade php7-fastcgiUpgrade php5-develUpgrade php7-pcntlUpgrade apache2-mod_php53Upgrade php7-sysvmsgUpgrade php5-intlUpgrade php5-xslUpgrade php53-mysqlUpgrade php53-mbstringUpgrade php53-tidyUpgrade php7-intlUpgrade php5-pcntlUpgrade php53-opensslUpgrade php5-zipUpgrade php5-suhosinUpgrade php53-sysvmsgUpgrade php53-jsonUpgrade php53-exifUpgrade php7-zlibUpgrade php5-pgsqlUpgrade php5-gdUpgrade php7-pearUpgrade php53-develUpgrade php53-domUpgrade php5-xmlrpcUpgrade php53-wddxUpgrade php5-zlibUpgrade php53-pgsqlUpgrade php7-zipUpgrade php7-soapUpgrade php5-snmpUpgrade php5Upgrade php7-sqliteUpgrade php7-xslUpgrade php53-ctypeUpgrade php7-pear-archive_tarUpgrade php7-opensslUpgrade php7-jsonUpgrade php5-mcryptUpgrade php7-mysqlUpgrade php53-dbaUpgrade php53-xmlwriterUpgrade php5-sqliteUpgrade php7-pspellUpgrade php5-ldapUpgrade php7-xmlreaderUpgrade php5-domUpgrade php53-pearUpgrade php53-gdUpgrade php5-enchantUpgrade php7-gettextUpgrade php7-xmlrpcUpgrade php53-sqliteUpgrade php53-xmlreaderUpgrade php53-zlibUpgrade php53-iconvUpgrade php7-shmopUpgrade php53-socketsUpgrade php5-odbcUpgrade php7-bz2Upgrade php53-fileinfoUpgrade php5-sysvsemUpgrade php7Upgrade php53-calendarUpgrade php53-pdoUpgrade php7-posixUpgrade php53-zipUpgrade php5-soapUpgrade php5-ftpUpgrade php7-ldapUpgrade php5-shmopUpgrade php7-gmpUpgrade php7-gdUpgrade php5-pdoUpgrade php53-pcntlUpgrade php5-pharUpgrade php7-mcryptUpgrade php53-sysvshmUpgrade php7-develUpgrade php53-imapUpgrade php5-iconvUpgrade php7-odbcUpgrade php7-dbaUpgrade php7-mbstringUpgrade php5-calendarUpgrade php5-mysqlUpgrade php7-exifUpgrade php5-tokenizerUpgrade php53-xslUpgrade php7-opcacheUpgrade php53Upgrade php5-xmlreaderUpgrade php7-imapUpgrade php53-shmopUpgrade php5-gmpUpgrade php53-posixUpgrade php5-bz2Upgrade php7-sysvshmUpgrade php5-curlUpgrade php5-socketsUpgrade php7-socketsUpgrade php5-sysvmsgUpgrade php5-pearUpgrade php5-mbstringUpgrade php5-exifUpgrade php7-domUpgrade php5-jsonUpgrade php5-dbaUpgrade php53-snmpUpgrade php53-readlineUpgrade php53-odbcUpgrade php5-fastcgiUpgrade php7-calendar | May 10, 2018 | Apr 29, 2018 |
| Ubuntu | — | Upgrade php5-cgiUpgrade libapache2-mod-php7.1Upgrade php7.2-cliUpgrade php5-fpmUpgrade libapache2-mod-php7.0Upgrade php7.1-cgiUpgrade php7.2-cgiUpgrade php7.0-cgiUpgrade libapache2-mod-php7.2Upgrade php7.0-fpmUpgrade php5-cliUpgrade php7.2-fpmUpgrade php7.1-fpmUpgrade php7.1-cliUpgrade php7.0-cliUpgrade libapache2-mod-php5 | May 23, 2018 | Apr 29, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub