CVSS v3
6.1
MEDIUM
EPSS Score
8.2%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
Active exploitation of CVE-2018-17082 has not been confirmed. The EPSS score is 8.2%, indicating the estimated probability of exploitation in the next 30 days.
CVE-2018-17082 has a CVSS v3 base score of 6.1 (MEDIUM severity).
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
Ranked by exploit probability (EPSS).