PT-2008-6329 · Nigel Mcnie · Geshi

Published 2008-11-21 · Updated 2024-08-07 · CVE-2008-5186

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Generic Syntax Highlighter (GeSHi) versions prior to 1.0.8.1

Description The set language path function in geshi.php might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). This issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate issues would be created for web applications that integrate GeSHi in a way that allows control of the default language path.

Recommendations For versions prior to 1.0.8.1, update to version 1.0.8.1 or later to resolve the issue. As a temporary workaround, consider restricting the influence of crafted inputs on the default language path ($path variable) to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-5186

DTSA-179-1

Affected Products

Geshi

References · 11

• https://osv.dev/vulnerability/CVE-2008-5186 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-5186 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5186 · Security Note
• http://sourceforge.net/project/shownotes.php?release_id=637321 · Patch
• http://securityfocus.com/bid/32070 · Patch
• http://secunia.com/advisories/32559 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5186 · Vendor Advisory
• https://t.me/cvenotify/89610 · Telegram Post
• http://openwall.com/lists/oss-security/2008/11/10/8 · Note
• http://osvdb.org/49488 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46271 · Note