CVE-2018-19518

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

95.23% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 99.9% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2018-11-25 10:00Z7 YR AGO

Last updated

2024-08-05 11:37Z2 YR AGO

Reserved

2018-11-25

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')Base
• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Base

Data version

5.1

Document digest

87cf0de58ef0870b6a503aebe9df18e301c0f3a452dbee293bf6c40ba28e8ff8

• bugs.php.nethttps://bugs.php.net/bug.php?id=77160x_refsource_MISC
• www.exploit-db.com45914https://www.exploit-db.com/exploits/45914/exploitx_refsource_EXPLOIT-DB
• lists.debian.org[debian-lts-announce] 20190301 [SECURITY] [DLA 1700-1] uw-imap security updatehttps://lists.debian.org/debian-lts-announce/2019/03/msg00001.htmlmailing-listx_refsource_MLIST
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20181221-0004/x_refsource_CONFIRM
• www.securitytracker.com1042157http://www.securitytracker.com/id/1042157vdb-entryx_refsource_SECTRACK
• www.debian.orgDSA-4353https://www.debian.org/security/2018/dsa-4353vendor-advisoryx_refsource_DEBIAN
• github.comhttps://github.com/Bo0oM/PHP_imap_open_exploit/blob/master/exploit.phpx_refsource_MISC
• bugs.debian.orghttps://bugs.debian.org/913835x_refsource_MISC
• www.openwall.comhttps://www.openwall.com/lists/oss-security/2018/11/22/3x_refsource_MISC
• git.php.nethttps://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e5bfea64c81ae34816479bb05d17cdffe45adddbx_refsource_CONFIRM
• www.securityfocus.com106018http://www.securityfocus.com/bid/106018vdb-entryx_refsource_BID
• bugs.php.nethttps://bugs.php.net/bug.php?id=76428x_refsource_MISC
• bugs.debian.orghttps://bugs.debian.org/913775x_refsource_MISC
• bugs.debian.orghttps://bugs.debian.org/913836x_refsource_MISC
• antichat.comhttps://antichat.com/threads/463395/#post-4254681x_refsource_MISC
• bugs.php.nethttps://bugs.php.net/bug.php?id=77153x_refsource_MISC
• lists.debian.org[debian-lts-announce] 20181217 [SECURITY] [DLA 1608-1] php5 security updatehttps://lists.debian.org/debian-lts-announce/2018/12/msg00006.htmlmailing-listx_refsource_MLIST
• usn.ubuntu.comUSN-4160-1https://usn.ubuntu.com/4160-1/vendor-advisoryx_refsource_UBUNTU
• security.gentoo.orgGLSA-202003-57https://security.gentoo.org/glsa/202003-57vendor-advisoryx_refsource_GENTOO
• lists.debian.org[debian-lts-announce] 20211229 [SECURITY] [DLA 2866-1] uw-imap security updatehttps://lists.debian.org/debian-lts-announce/2021/12/msg00031.htmlmailing-listx_refsource_MLIST