CVE-2004-0595

2004-07-2704:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2004-0595

php

function

null characters

tag names

web browsers

internet explorer

safari

cross-site scripting

xss

vulnerability

5.3 Medium

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.939 High

EPSS

Percentile

99.1%

JSON

The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.

CPENameOperatorVersion
redhat:fedora_coreredhat fedora coreeqcore_2.0
trustix:secure_linuxtrustix secure linuxeq2.0
redhat:fedora_coreredhat fedora coreeqcore_1.0
avaya:converged_communications_serveravaya converged communications servereq2.0
trustix:secure_linuxtrustix secure linuxeq1.5
trustix:secure_linuxtrustix secure linuxeq2.1
avaya:s8500avaya s8500eqr2.0.1
php:phpphpeq4.2.0
php:phpphpeq4.1.0
php:phpphpeq4.0.4

CPE	Name	Operator	Version
redhat:fedora_core	redhat fedora core	eq	core_2.0
trustix:secure_linux	trustix secure linux	eq	2.0
redhat:fedora_core	redhat fedora core	eq	core_1.0
avaya:converged_communications_server	avaya converged communications server	eq	2.0
trustix:secure_linux	trustix secure linux	eq	1.5
trustix:secure_linux	trustix secure linux	eq	2.1
avaya:s8500	avaya s8500	eq	r2.0.1
php:php	php	eq	4.2.0
php:php	php	eq	4.1.0
php:php	php	eq	4.0.4