Cross-site scripting in PHP - CVE-2018-10547

Vulnerability identifier: #VU12327

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2018-10547

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in the phar_do_404() and phar_do_403() functions due to insufficient sanitization of user-supplied data processed by the phar_do_404() and phar_do_403() functions, as defined in the ext/phar/phar_object.c source code file. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

The vulnerability exists due to an incomplete fix for CVE-2018-5712.

PHP
Amazon Linux AMI
Debian Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
SUSE Linux
Slackware Linux
Fedora
Opensuse
php (Red Hat package)
php5 (Alpine package)
php7 (Alpine package)
openSUSE Leap
php

The vulnerability is addressed in the following versions: 5.6.36, 7.1.17, 7.2.5 and 7.0.30.

php (Red Hat package) - update to 5.4.16-48.el7
php7 (Alpine package) - update to 7.1.30-r0
php - addressed in versions 7.1.17-1.fc26, 7.1.17-1.fc27, 7.2.5-1.fc28

• https://bugs.php.net/bug.php?id=76129

• Multiple vulnerabilities in PHP
• SUSE Linux update for php7
• OpenSUSE Linux update for php7
• Amazon Linux AMI update for php56, php70, php71
• Slackware Linux update for php
• OpenSUSE Linux update for php5
• Debian update for php7.0
• Red Hat update for 389-ds-base
• Red Hat update for 389-ds-base
• Red Hat Enterprise Linux 7 update for php
• Cross-site scripting in php7 (Alpine package)
• Cross-site scripting in php5 (Alpine package)
• Fedora 28 update for php
• Fedora 27 update for php
• Fedora 26 update for php