CVE-2018-17082

    Dashboard / Vulnerabilities / CVE-2018-17082

    CVE-2018-17082

    Published: 16 Sept 2018Last Modified: 7 Aug 2026

    Summary:

    Details: The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.

    References: https://www.tenable.com/security/tns-2019-07, http://php.net/ChangeLog-5.php, http://php.net/ChangeLog-7.php, https://access.redhat.com/errata/RHSA-2019:2519, https://lists.debian.org/debian-lts-announce/2018/09/msg00020.html, https://security.gentoo.org/glsa/201812-01, https://security.netapp.com/advisory/ntap-20180924-0001/, https://www.debian.org/security/2018/dsa-4353, https://bugs.php.net/bug.php?id=76582, https://github.com/php/php-src/commit/23b057742e3cf199612fa8050ae86cae675e214e

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -b0822792c8d4c8d535ea1beb8ea63025496668e7

    Affected versions

    POST_PHP7_NSAPI_REMOVAL

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High