CVE-2008-5814: XSS

Q: What is the severity of CVE-2008-5814?

CVE-2008-5814 is categorized as a high severity vulnerability due to its potential for remote code execution through cross-site scripting.

Q: How do I fix CVE-2008-5814?

To fix CVE-2008-5814, ensure that display_errors is disabled in your PHP configuration or upgrade to a fixed version of PHP, above 5.2.7.

Q: What versions of PHP are affected by CVE-2008-5814?

CVE-2008-5814 affects multiple versions of PHP, including all versions up to 5.2.7.

Q: Who exploits CVE-2008-5814?

CVE-2008-5814 can be exploited by remote attackers who can inject arbitrary web scripts or HTML into affected systems.

Q: What are the consequences of CVE-2008-5814 exploitation?

Exploitation of CVE-2008-5814 can lead to unauthorized access and execution of malicious scripts in the context of the user's session.

Published Jan 2, 2009

Updated

Cross-site scripting (XSS) vulnerability in PHP, possibly 5.2.7 and earlier, when displayerrors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208.

Affected Software

109 affected components

PHP PHP=4.3.9

PHP PHP=4.4.9

PHP PHP=3.0

PHP PHP=4.0-beta1

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.4.4

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=5.1.6

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=5.2.2

PHP PHP=3.0.8

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=4.0.7-rc4

PHP PHP=5.1.4

PHP PHP=5.2.5

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.0-rc1

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=4.0.3-patch1

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=2.0

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=5.2.6

PHP PHP=4.4.3

PHP PHP=5.0.0-rc2

PHP PHP=5.2.3

PHP PHP=5.0.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.4.5

PHP PHP=4.0.1-patch1

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=2.0b10

PHP PHP=4.4.8

PHP PHP=4.0.6

PHP PHP=5.2.0

PHP PHP=5.0-rc2

PHP PHP=5.2.4

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=5.1.3

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP<=5.2.7

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=1.0

PHP PHP=5.0.2

PHP PHP=4.4.6

PHP PHP=3.0.12

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=5.2.1

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

PHP PHP=4.4.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Disable display_errors by setting display_errors = Off in php.ini (or equivalent runtime configuration) to prevent error output that can be used for XSS.
PHP display_errors = Off

Event History

Jan 2, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via NVD·06:11 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-5814?

CVE-2008-5814 is categorized as a high severity vulnerability due to its potential for remote code execution through cross-site scripting.

How do I fix CVE-2008-5814?