PT-2008-6329 · Nigel Mcnie · Geshi

CVE-2008-5186 · Publicado 2008-11-21 · Atualizado 2024-08-07

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Generic Syntax Highlighter (GeSHi) versions prior to 1.0.8.1

Description The set language path function in geshi.php might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). This issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate issues would be created for web applications that integrate GeSHi in a way that allows control of the default language path.

Recommendations For versions prior to 1.0.8.1, update to version 1.0.8.1 or later to resolve the issue. As a temporary workaround, consider restricting the influence of crafted inputs on the default language path ($path variable) to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-5186

DTSA-179-1

Produtos afetados

Geshi

Referências · 11

• https://osv.dev/vulnerability/CVE-2008-5186 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2008-5186 · Aviso do Fabricante
• https://t.me/cvenotify/89610 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2008-5186 · Nota de Segurança
• http://sourceforge.net/project/shownotes.php?release_id=637321 · Correção
• http://openwall.com/lists/oss-security/2008/11/10/8 · Nota
• http://securityfocus.com/bid/32070 · Correção
• http://secunia.com/advisories/32559 · Aviso do Fabricante
• http://osvdb.org/49488 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46271 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5186 · Aviso do Fabricante