Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-dcbh-qs9z-ubaw
Summary
Multiple vulnerabilities have been found in PHP, the worst of which
    could result in the execution of arbitrary shell commands.
Aliases
0
alias CVE-2018-19518
Fixed_packages
0
url pkg:apk/alpine/php7@7.1.29-r0?arch=x86&distroversion=v3.7&reponame=community
purl pkg:apk/alpine/php7@7.1.29-r0?arch=x86&distroversion=v3.7&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=x86&distroversion=v3.7&reponame=community
1
url pkg:apk/alpine/php7@7.1.29-r0?arch=armhf&distroversion=v3.7&reponame=community
purl pkg:apk/alpine/php7@7.1.29-r0?arch=armhf&distroversion=v3.7&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=armhf&distroversion=v3.7&reponame=community
2
url pkg:apk/alpine/php7@7.1.29-r0?arch=s390x&distroversion=v3.7&reponame=community
purl pkg:apk/alpine/php7@7.1.29-r0?arch=s390x&distroversion=v3.7&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=s390x&distroversion=v3.7&reponame=community
3
url pkg:apk/alpine/php7@7.1.29-r0?arch=x86_64&distroversion=v3.7&reponame=community
purl pkg:apk/alpine/php7@7.1.29-r0?arch=x86_64&distroversion=v3.7&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=x86_64&distroversion=v3.7&reponame=community
4
url pkg:apk/alpine/php7@7.1.29-r0?arch=aarch64&distroversion=v3.7&reponame=community
purl pkg:apk/alpine/php7@7.1.29-r0?arch=aarch64&distroversion=v3.7&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=aarch64&distroversion=v3.7&reponame=community
5
url pkg:apk/alpine/php7@7.1.29-r0?arch=ppc64le&distroversion=v3.7&reponame=community
purl pkg:apk/alpine/php7@7.1.29-r0?arch=ppc64le&distroversion=v3.7&reponame=community
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=ppc64le&distroversion=v3.7&reponame=community
6
url pkg:deb/debian/uw-imap@8:2007f~dfsg-6?distro=bullseye
purl pkg:deb/debian/uw-imap@8:2007f~dfsg-6?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-6%3Fdistro=bullseye
7
url pkg:deb/debian/uw-imap@8:2007f~dfsg-6
purl pkg:deb/debian/uw-imap@8:2007f~dfsg-6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-6
8
url pkg:deb/debian/uw-imap@8:2007f~dfsg-7?distro=bullseye
purl pkg:deb/debian/uw-imap@8:2007f~dfsg-7?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-7%3Fdistro=bullseye
9
url pkg:ebuild/dev-lang/php@7.2.29
purl pkg:ebuild/dev-lang/php@7.2.29
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:ebuild/dev-lang/php@7.2.29
10
url pkg:ebuild/dev-lang/php@7.3.16
purl pkg:ebuild/dev-lang/php@7.3.16
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:ebuild/dev-lang/php@7.3.16
11
url pkg:ebuild/dev-lang/php@7.4.4
purl pkg:ebuild/dev-lang/php@7.4.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:ebuild/dev-lang/php@7.4.4
Affected_packages
0
url pkg:deb/debian/uw-imap@4:2001adebian-6
purl pkg:deb/debian/uw-imap@4:2001adebian-6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3exb-uh1x-rkf8
1
vulnerability VCID-5scr-2vxt-e7gz
2
vulnerability VCID-6jh1-37ph-2bev
3
vulnerability VCID-75gm-tz5w-qfan
4
vulnerability VCID-anhs-xyx5-4fbf
5
vulnerability VCID-dcbh-qs9z-ubaw
6
vulnerability VCID-sme9-5sz7-yuh2
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@4:2001adebian-6
1
url pkg:deb/debian/uw-imap@7:2002edebian1-11sarge1
purl pkg:deb/debian/uw-imap@7:2002edebian1-11sarge1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3exb-uh1x-rkf8
1
vulnerability VCID-6jh1-37ph-2bev
2
vulnerability VCID-75gm-tz5w-qfan
3
vulnerability VCID-dcbh-qs9z-ubaw
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@7:2002edebian1-11sarge1
2
url pkg:deb/debian/uw-imap@7:2002edebian1-13.1
purl pkg:deb/debian/uw-imap@7:2002edebian1-13.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3exb-uh1x-rkf8
1
vulnerability VCID-6jh1-37ph-2bev
2
vulnerability VCID-dcbh-qs9z-ubaw
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@7:2002edebian1-13.1
3
url pkg:deb/debian/uw-imap@7:2002edebian1-13.1%2Betch1
purl pkg:deb/debian/uw-imap@7:2002edebian1-13.1%2Betch1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3exb-uh1x-rkf8
1
vulnerability VCID-6jh1-37ph-2bev
2
vulnerability VCID-dcbh-qs9z-ubaw
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@7:2002edebian1-13.1%252Betch1
4
url pkg:deb/debian/uw-imap@7:2007b~dfsg-4%2Blenny3
purl pkg:deb/debian/uw-imap@7:2007b~dfsg-4%2Blenny3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3exb-uh1x-rkf8
1
vulnerability VCID-6jh1-37ph-2bev
2
vulnerability VCID-dcbh-qs9z-ubaw
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@7:2007b~dfsg-4%252Blenny3
5
url pkg:deb/debian/uw-imap@8:2007e~dfsg-3.1
purl pkg:deb/debian/uw-imap@8:2007e~dfsg-3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dcbh-qs9z-ubaw
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007e~dfsg-3.1
6
url pkg:deb/debian/uw-imap@8:2007f~dfsg-2
purl pkg:deb/debian/uw-imap@8:2007f~dfsg-2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dcbh-qs9z-ubaw
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-2
7
url pkg:deb/debian/uw-imap@8:2007f~dfsg-4
purl pkg:deb/debian/uw-imap@8:2007f~dfsg-4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dcbh-qs9z-ubaw
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-4
8
url pkg:deb/debian/uw-imap@8:2007f~dfsg-5
purl pkg:deb/debian/uw-imap@8:2007f~dfsg-5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dcbh-qs9z-ubaw
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-5
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-19518.json
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-19518.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-19518
reference_id
reference_type
scores
0
value 0.93869
scoring_system epss
scoring_elements 0.99871
published_at 2026-04-18T12:55:00Z
1
value 0.93869
scoring_system epss
scoring_elements 0.9987
published_at 2026-04-13T12:55:00Z
2
value 0.93956
scoring_system epss
scoring_elements 0.99883
published_at 2026-04-04T12:55:00Z
3
value 0.93956
scoring_system epss
scoring_elements 0.99882
published_at 2026-04-02T12:55:00Z
4
value 0.93956
scoring_system epss
scoring_elements 0.99884
published_at 2026-04-08T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-19518
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14851
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14851
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14883
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14883
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17082
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17082
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19518
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19518
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19935
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19935
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20783
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20783
8
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1654228
reference_id 1654228
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1654228
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914632
reference_id 914632
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914632
11
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/45914.rb
reference_id CVE-2018-19518
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/45914.rb
12
reference_url https://raw.githubusercontent.com/rapid7/metasploit-framework/b3ad4a03581f53c670d91e82d2a4ef00ec392f8f/modules/exploits/linux/http/php_imap_open_rce.rb
reference_id CVE-2018-19518
reference_type exploit
scores
url https://raw.githubusercontent.com/rapid7/metasploit-framework/b3ad4a03581f53c670d91e82d2a4ef00ec392f8f/modules/exploits/linux/http/php_imap_open_rce.rb
13
reference_url https://security.gentoo.org/glsa/202003-57
reference_id GLSA-202003-57
reference_type
scores
url https://security.gentoo.org/glsa/202003-57
14
reference_url https://usn.ubuntu.com/4160-1/
reference_id USN-4160-1
reference_type
scores
url https://usn.ubuntu.com/4160-1/
Weaknesses
0
cwe_id 78
name Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
description The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Exploits
0
date_added 2018-11-29
description PHP imap_open - Remote Code Execution (Metasploit)
required_action null
due_date null
notes null
known_ransomware_campaign_use true
source_date_published 2018-11-29
exploit_type remote
platform linux
source_date_updated 2018-11-29
data_source Exploit-DB
source_url https://raw.githubusercontent.com/rapid7/metasploit-framework/b3ad4a03581f53c670d91e82d2a4ef00ec392f8f/modules/exploits/linux/http/php_imap_open_rce.rb
1
date_added null
description 
The imap_open function within php, if called without the /norsh flag, will attempt to preauthenticate an
          IMAP session.  On Debian based systems, including Ubuntu, rsh is mapped to the ssh binary.  Ssh's ProxyCommand
          option can be passed from imap_open to execute arbitrary commands.
          While many custom applications may use imap_open, this exploit works against the following applications:
          e107 v2, prestashop, SuiteCRM, as well as Custom, which simply prints the exploit strings for use.
          Prestashop exploitation requires the admin URI, and administrator credentials.
          suiteCRM/e107 require administrator credentials.  Fixed in php 5.6.39.
required_action null
due_date null
notes 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
known_ransomware_campaign_use false
source_date_published 2018-10-23
exploit_type null
platform Unix
source_date_updated null
data_source Metasploit
source_url https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/http/php_imap_open_rce.rb
Severity_range_score5.3 - 8.1
Exploitability2.0
Weighted_severity7.3
Risk_score10.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-dcbh-qs9z-ubaw