blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2018-5712

MEDIUM 6.1 CVSS 3.0
Published
January 16, 2018
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-79
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.

Affected products and versions

  • PHP — Up to and including 5.6.32
  • PHP — From 7.0.0 (including) to 7.0.26 (including)
  • PHP — From 7.1.0 (excluding) to 7.1.12 (including)
  • PHP versions 7.2.0

References

  • php.net http://php.net/ChangeLog-5.php Release Notes, Vendor Advisory
  • php.net http://php.net/ChangeLog-7.php Release Notes, Vendor Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/102742 Third Party Advisory, VDB Entry
  • www.securityfocus.com http://www.securityfocus.com/bid/104020 Third Party Advisory, VDB Entry
  • www.securitytracker.com http://www.securitytracker.com/id/1040363 Third Party Advisory, VDB Entry
  • access.redhat.com https://access.redhat.com/errata/RHSA-2018:1296 Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:2519
  • bugs.php.net https://bugs.php.net/bug.php?id=74782 Issue Tracking, Patch, Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2018/01/msg00025.html Mailing List, Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/3566-1/ Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/3600-1/ Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/3600-2/ Third Party Advisory
  • www.oracle.com https://www.oracle.com/security-alerts/cpuapr2020.html
  • nvd.nist.gov Official NVD record