PT-2004-1691 · Microsoft+2 · Internet Explorer+2
Stefan Esser
·
Publicado
2004-07-16
·
Atualizado
2018-10-30
·
CVE-2004-0595
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions 4.x up to 4.3.7
PHP versions 5.x up to 5.0.0RC3
Description
The issue concerns the
strip tags function, which fails to filter null characters within tag names, allowing dangerous tags to be processed by web browsers like Internet Explorer and Safari. This facilitates the exploitation of cross-site scripting (XSS) vulnerabilities.Recommendations
For PHP versions 4.x up to 4.3.7, update to a version that fixes this issue.
For PHP versions 5.x up to 5.0.0RC3, update to a version that fixes this issue.
As a temporary workaround, consider manually filtering null characters from tag names to prevent XSS exploitation.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Internet Explorer
Php
Safari