Description

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.

Remediation

References

CVE-2018-17082

Related Vulnerabilities

PHP Other Vulnerability (CVE-2011-0420)

Microsoft SQL Server Elevation of Privilege Vulnerability (CVE-2021-1636)

MySQL CVE-2012-3150 Vulnerability (CVE-2012-3150)

WordPress Plugin SEO Backdoor (5.0)

WordPress Plugin LeadConnector Security Bypass (1.7)

Severity

Medium

Classification

CVE-2018-17082 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities