XML-RPC for PHP's debugger vulnerable to possible XSS attack
The advisory, in context
The bundled xml-rpc debugger is susceptible to XSS attacks.
Since the debugger is not designed to be exposed to end users but only to the developers using this library, and in the default configuration it is not exposed to requests from the web, the likelihood of exploitation may be low.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 4.9.2
Fixed in 4.9.2
32 explicitly affected versions
3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.1.2, 4.0.0, 4.0.0-alpha, 4.0.1, 4.1.0, 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.3.2, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.5.0, 4.5.1, 4.5.2, 4.6.0, 4.6.1, 4.7.0, 4.7.1, 4.7.2, 4.8.0, 4.8.1, 4.9.0, 4.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.9.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0",
"3.0.1",
"3.1.0",
"3.1.1",
"3.1.2",
"4.0.0",
"4.0.0-alpha",
"4.0.1",
"4.1.0",
"4.1.1",
"4.2.0",
"4.2.1",
"4.2.2",
"4.3.0",
"4.3.1",
"4.3.2",
"4.4.0",
"4.4.1",
"4.4.2",
"4.4.3",
"4.5.0",
"4.5.1",
"4.5.2",
"4.6.0",
"4.6.1",
"4.7.0",
"4.7.1",
"4.7.2",
"4.8.0",
"4.8.1",
"4.9.0",
"4.9.1"
]
}