CVE-2008-5625

2008-12-1717:30:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2008-5625

php 5

file write vulnerability

safe_mode restriction

nvd

6.3 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.016 Low

EPSS

Percentile

87.2%

JSON

PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a “php_value error_log” entry in a .htaccess file.

CPENameOperatorVersion
php:phpphpeq5.1.5
php:phpphpeq5.1.2
php:phpphpeq5.1.1
php:phpphpeq5.0.0
php:phpphpeq5.1.6
php:phpphpeq5.2.2
php:phpphpeq5.0.5
php:phpphpeq5.0.1
php:phpphpeq5.1.4
php:phpphpeq5.2.5

CPE	Name	Operator	Version
php:php	php	eq	5.1.5
php:php	php	eq	5.1.2
php:php	php	eq	5.1.1
php:php	php	eq	5.0.0
php:php	php	eq	5.1.6
php:php	php	eq	5.2.2
php:php	php	eq	5.0.5
php:php	php	eq	5.0.1
php:php	php	eq	5.1.4
php:php	php	eq	5.2.5