CVE-2004-0595
- State
- Published
- Severity
- Not scored
- Published
- Jul 16, 2004
- Updated
- Aug 8, 2024
- Reserved
- Jun 23, 2004
Description
The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- CLA-2004:847vendor-advisory
- 20040714 TSSA-2004-013 - phpmailing-list
- DSA-669vendor-advisory
- oval:org.mitre.oval:def:10619vdb-entrysignature
- RHSA-2004:395vendor-advisory
- RHSA-2004:405vendor-advisory
- RHSA-2004:392vendor-advisory
- DSA-531vendor-advisory
- SUSE-SA:2004:021vendor-advisory
- MDKSA-2004:068vendor-advisory
- php-strip-tag-bypass(16692)vdb-entry
- RHSA-2005:816vendor-advisory
- SSRT4777vendor-advisory
- 20040722 [OpenPKG-SA-2004.034] OpenPKG Security Advisory (php)mailing-list
- 10724vdb-entry
- 20040713 Advisory 11/2004: PHP memory_limit remote vulnerabilitymailing-list
- GLSA-200407-13vendor-advisory
- 20040714 Advisory 12/2004: PHP strip_tags() bypass vulnerabilitymailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.