CVE-2018-5712

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-5712
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-5712.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2018-5712
Downstream
Related
Published
2018-01-16T09:29:00.623Z
Modified
2026-07-07T08:49:57.213805453Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "12.04"
                },
                {
                    "last_affected": "12.04"
                },
                {
                    "introduced": "14.04"
                },
                {
                    "last_affected": "14.04"
                },
                {
                    "introduced": "16.04"
                },
                {
                    "last_affected": "16.04"
                },
                {
                    "introduced": "17.10"
                },
                {
                    "last_affected": "17.10"
                }
            ],
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*"
            ],
            "vendor_product": "canonical:ubuntu_linux",
            "source": "CPE_STRING"
        },
        {
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0"
                }
            ],
            "vendor_product": "debian:debian_linux",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6f21492505dd554667f70884b46802f2fb81c210
Last affected
2d16947f209c40fa4cccc56833aa0807790d52b8
Introduced
60fffd296abce5fc071f3c173c25a2696cf683c6
Last affected
532aa2d2aeb4a1f590f30d4063445473182f9a38
Introduced
8148cbb78841c8ec0759c0836e7f35dec799d300
Last affected
8148cbb78841c8ec0759c0836e7f35dec799d300
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.6.32"
        },
        {
            "last_affected": "7.1.12"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.0.26"
        },
        {
            "introduced": "7.2.0"
        },
        {
            "last_affected": "7.2.0"
        }
    ],
    "cpe": [
        "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.2.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

7.*
7.2.0
Other
POST_64BIT_BRANCH_MERGE
POST_AST_MERGE
POST_PHP7_NSAPI_REMOVAL
POST_PHP7_REMOVALS
POST_PHPNG_MERGE
PRE_64BIT_BRANCH_MERGE
PRE_AST_MERGE
PRE_PHP7_EREG_MYSQL_REMOVALS
PRE_PHP7_NSAPI_REMOVAL
PRE_PHP7_REMOVALS
l
php-5.*
php-5.6.32
php-7.*
php-7.0.26
php-7.0.26RC1
php-7.1.12
php-7.1.12RC1
php-7.2.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-5712.json"