The Apache2 component in PHP prior to 5.6.38, 7.0.x prior to 7.0.32, 7.1.x prior to 7.1.22, and 7.2.x prior to 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
php php |
||
debian debian linux 9.0 |
||
debian debian linux 8.0 |
||
netapp storage automation store - |