CVE-2008-5814
LOW severity · CVSS 2.6 · Cross-site scripting (XSS)
2.6CVSS LOW
Summary
Cross-site scripting (XSS) vulnerability in PHP, possibly 5.2.7 and earlier, when display_errors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208.
Impact & exploitability
Attack vectorNetwork
Attack complexityHigh
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impact—
Availability impactNone
Exploit probability (EPSS)2%
AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
- http://jvn.jp/en/jp/JVN50327700/index.html
- http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000084.html
- http://marc.info/?l=bugtraq&m=124277349419254&w=2
- http://secunia.com/advisories/34830
- http://secunia.com/advisories/34933
- http://secunia.com/advisories/35003
- http://secunia.com/advisories/35007