CVE-2018-10547: An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5

Description

An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)3.4% · higher than 89% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PH

PHP · PHP

before 5.6.36; 7.0.0 before 7.0.30; 7.1.0 before 7.1.17; 7.2.0 before 7.2.5 · source: NVD

DL

Debian Linux · Debian

7.0; 8.0; 9.0 · source: NVD

SA

Storage Automation Store · Netapp

All versions, or not specified · source: NVD

UL

Ubuntu Linux · Canonical

12.04; 14.04; 16.04; 17.10; 18.04 · source: NVD