Attacker Value
Very High
CVE-2008-0599
CVE-2008-0599
(Last updated February 03, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Discovery
Techniques
Validation
Description
The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.
Add Assessment
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- apple,
- canonical,
- fedoraproject,
- php
Products
- fedora 8,
- fedora 9,
- mac os x,
- mac os x server,
- php,
- ubuntu linux 6.06,
- ubuntu linux 7.04,
- ubuntu linux 7.10,
- ubuntu linux 8.04
References
Advisory
