CVE-2007-1454 Common Vulnerabilities and Exposures

Upstream information

CVE-2007-1454 at MITRE

Description

ext/filter in PHP 5.2.0, when FILTER_SANITIZE_STRING is used with the FILTER_FLAG_STRIP_LOW flag, does not properly strip HTML tags, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML with a '<' character followed by certain whitespace characters, which passes one filter but is collapsed into a valid tag, as demonstrated using %0b.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
	National Vulnerability Database
Base Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	None
Integrity Impact	Partial
Availability Impact	None

SUSE Bugzilla entry: 253476 [RESOLVED / FIXED]

SUSE Security Advisories:

SUSE-SA:2007:032, published Wed, 23 May 2007 12:00:00 +0000

SUSE Timeline for this CVE

CVE page created: Fri Jun 28 02:42:51 2013
CVE page last modified: Fri Dec 8 16:20:10 2023