CVE-2005-3388: XSS
Published Nov 1, 2005
·Updated
Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a "stacked array assignment."
Affected Software
48 affected components
PHP PHP=4.3.9
PHP PHP=4.2.0
PHP PHP=5.0.0-beta1
PHP PHP=4.1.0
PHP PHP=4.3.4
PHP PHP=4.0.4
PHP PHP=4.3.0
PHP PHP=4.0.5
PHP PHP=5.0.5
PHP PHP=4.3.6
PHP PHP=5.0.1
PHP PHP=4.0.7-rc2
PHP PHP=4.3.7
PHP PHP=5.0.4
PHP PHP=4.0.7-rc1
PHP PHP=4.2.2
PHP PHP=4.3.2
PHP PHP=4.3.11
PHP PHP=4.0.0
PHP PHP=4.0.3-patch1
PHP PHP=4.0.7
PHP PHP=4.0.2
PHP PHP=4.3.3
PHP PHP=4.1.1
PHP PHP=5.0.0-rc2
PHP PHP=5.0.3
PHP PHP=4.2.3
PHP PHP=4.0.1-patch1
PHP PHP=5.0.0-rc3
PHP PHP=4.0.1-patch2
PHP PHP=4.0.6
PHP PHP=4.1.2
PHP PHP=5.0.0-beta3
PHP PHP=4.0.7-rc3
PHP PHP=4.3.1
PHP PHP=4.4.0
PHP PHP=4.3.10
PHP PHP=4.2.1
PHP PHP=5.0.0-rc1
PHP PHP=4.0.1
PHP PHP=5.0.2
PHP PHP=4.2
PHP PHP=4.0.3
PHP PHP=5.0.0-beta4
PHP PHP=5.0.0
PHP PHP=4.3.8
PHP PHP=4.3.5
PHP PHP=5.0.0-beta2
Remediation
Patch Available
Patch Available
Patch Available
Event History
Nov 1, 2005
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-3388?
CVE-2005-3388 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2005-3388?
To fix CVE-2005-3388, upgrade to PHP version 5.0.5 or later, or apply relevant security patches provided by PHP.
3
What are the affected versions in CVE-2005-3388?
CVE-2005-3388 affects PHP versions 4.x up to 4.4.0 and 5.x up to 5.0.5.
4
What type of vulnerability is CVE-2005-3388?
CVE-2005-3388 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web script or HTML.
5
Can CVE-2005-3388 be exploited remotely?
Yes, CVE-2005-3388 can be exploited remotely through crafted URLs that trigger the vulnerability.