Cross-Site Scripting (XSS)

2020-04-1000:31:24

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

JSON

php is vulnerable to cross-site scripting. A cross-site scripting flaw was found in a way PHP reported errors for invalid cookies. If the PHP interpreter had “display_errors” enabled, a remote attacker able to set a specially-crafted cookie on a victim’s system could possibly inject arbitrary HTML into an error message generated by PHP.

CPENameOperatorVersion
phpeq5.1.6__11.el5
phpeq5.1.6__7.el5
phpeq5.1.6__20.el5_2.1
phpeq5.2.6__2.el5s2
phpeq5.1.6__23.el5
phpeq5.1.6__12.el5
phpeq5.1.6__20.el5
phpeq5.1.6__23.2.el5_3
phpeq5.2.3__1.el5s2
phpeq5.1.6__15.el5

Name	Operator	Version
php	eq	5.1.6__11.el5
php	eq	5.1.6__7.el5
php	eq	5.1.6__20.el5_2.1
php	eq	5.2.6__2.el5s2
php	eq	5.1.6__23.el5
php	eq	5.1.6__12.el5
php	eq	5.1.6__20.el5
php	eq	5.1.6__23.2.el5_3
php	eq	5.2.3__1.el5s2
php	eq	5.1.6__15.el5