Headline
GHSA-pxqj-xrv5-qvjf: XML-RPC for PHP's debugger vulnerable to possible XSS attack
The bundled xml-rpc debugger is susceptible to XSS attacks.
Since the debugger is not designed to be exposed to end users but only to the developers using this library, and in the default configuration it is not exposed to requests from the web, the likelihood of exploitation may be low.
- GitHub Advisory Database
- GitHub Reviewed
- GHSA-pxqj-xrv5-qvjf
XML-RPC for PHP’s debugger vulnerable to possible XSS attack
Moderate severity GitHub Reviewed Published Jan 11, 2023 in gggeek/phpxmlrpc • Updated Jan 11, 2023
Vulnerability details Dependabot alerts 0
Package
composer phpxmlrpc/phpxmlrpc (Composer)
Affected versions
< 4.9.2
Patched versions
4.9.2
Description
The bundled xml-rpc debugger is susceptible to XSS attacks.
Since the debugger is not designed to be exposed to end users but only to the developers using this library, and in the default configuration it is not exposed to requests from the web, the likelihood of exploitation may be low.
References
- GHSA-pxqj-xrv5-qvjf
- https://github.com/gggeek/phpxmlrpc/releases/tag/4.9.2
gggeek published the maintainer security advisory
Jan 11, 2023
Severity
Moderate
Weaknesses
CWE-79
CVE ID
No known CVE
GHSA ID
GHSA-pxqj-xrv5-qvjf
Source code
gggeek/phpxmlrpc
Checking history
See something to contribute? Suggest improvements for this vulnerability.