CVE-2008-3660

Advisory lineage Upstream: 0 Downstream: 4
Modified
Published: 15 Aug 2008, 00:00
Last modified:07 Aug 2024, 09:45

Vulnerability Summary

Overall Risk (default)
low
23/100
CVSS Score
5 MEDIUM
v2.0 (nvd)
EPSS Score
14.12% MEDIUM
14% probability -1.85%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Aug 2008, 00:00
Published
Vulnerability first disclosed
07 Aug 2024, 09:45
Last Modified
Vulnerability information updated

Description

PHP 4.4.x before 4.4.9, and 5.x through 5.2.6, when used as a FastCGI module, allows remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension, as demonstrated using foo..php.

CVSS Metrics

  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 14.12%• Percentile: 94%

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected Systems

  • Unknown•PHP

    4.4.0 | 4.4.1 | 4.4.2 | 4.4.3 | 4.4.4 | 4.4.5 | 4.4.6 | 4.4.7 | 4.4.8 | 5.2.0 | 5.2.1 | 5.2.2 | 5.2.3 | 5.2.4 | 5.2.5 | 5.2.6

References (31)