Lucene search

MitreCVE-2004-0595

HistoryJul 27, 2004 - 4:00 a.m.

CVE-2004-0595

2004-07-2704:00:00

mitre

web.nvd.nist.gov

cve-2004-0595

php

function

null characters

tag names

web browsers

internet explorer

safari

cross-site scripting

xss

vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

5.3

Confidence

High

EPSS

0.939

Percentile

99.2%

JSON

The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.

Affected configurations

Nvd

Node

avayaconverged_communications_serverMatch2.0

redhatfedora_coreMatchcore_1.0

redhatfedora_coreMatchcore_2.0

trustixsecure_linuxMatch1.5

trustixsecure_linuxMatch2.0

trustixsecure_linuxMatch2.1

Node

avayaintegrated_management

phpphpMatch4.0

phpphpMatch4.0.1

phpphpMatch4.0.2

phpphpMatch4.0.3

phpphpMatch4.0.4

phpphpMatch4.0.5

phpphpMatch4.0.6

phpphpMatch4.0.7

phpphpMatch4.1.0

phpphpMatch4.1.1

phpphpMatch4.1.2

phpphpMatch4.2.0

phpphpMatch4.2.1

phpphpMatch4.2.2

phpphpMatch4.2.3

phpphpMatch4.3.0

phpphpMatch4.3.1

phpphpMatch4.3.2

phpphpMatch4.3.3

phpphpMatch4.3.5

phpphpMatch4.3.6

phpphpMatch4.3.7

phpphpMatch5.0rc1

phpphpMatch5.0rc2

phpphpMatch5.0rc3

avayas8300Matchr2.0.0

avayas8300Matchr2.0.1

avayas8500Matchr2.0.0

avayas8500Matchr2.0.1

avayas8700Matchr2.0.0

avayas8700Matchr2.0.1

VendorProductVersionCPE
avayaconverged_communications_server2.0cpe:2.3:h:avaya:converged_communications_server:2.0:*:*:*:*:*:*:*
redhatfedora_corecore_1.0cpe:2.3:o:redhat:fedora_core:core_1.0:*:*:*:*:*:*:*
redhatfedora_corecore_2.0cpe:2.3:o:redhat:fedora_core:core_2.0:*:*:*:*:*:*:*
trustixsecure_linux1.5cpe:2.3:o:trustix:secure_linux:1.5:*:*:*:*:*:*:*
trustixsecure_linux2.0cpe:2.3:o:trustix:secure_linux:2.0:*:*:*:*:*:*:*
trustixsecure_linux2.1cpe:2.3:o:trustix:secure_linux:2.1:*:*:*:*:*:*:*
avayaintegrated_management*cpe:2.3:a:avaya:integrated_management:*:*:*:*:*:*:*:*
phpphp4.0cpe:2.3:a:php:php:4.0:*:*:*:*:*:*:*
phpphp4.0.1cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
phpphp4.0.2cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
avaya	converged_communications_server	2.0	cpe:2.3:h:avaya:converged_communications_server:2.0:::::::*
redhat	fedora_core	core_1.0	cpe:2.3:o:redhat:fedora_core:core_1.0:::::::*
redhat	fedora_core	core_2.0	cpe:2.3:o:redhat:fedora_core:core_2.0:::::::*
trustix	secure_linux	1.5	cpe:2.3:o:trustix:secure_linux:1.5:::::::*
trustix	secure_linux	2.0	cpe:2.3:o:trustix:secure_linux:2.0:::::::*
trustix	secure_linux	2.1	cpe:2.3:o:trustix:secure_linux:2.1:::::::*
avaya	integrated_management	*	cpe:2.3:a:avaya:integrated_management::::::::
php	php	4.0	cpe:2.3:a:php:php:4.0:::::::*
php	php	4.0.1	cpe:2.3:a:php:php:4.0.1:::::::*
php	php	4.0.2	cpe:2.3:a:php:php:4.0.2:::::::*