The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2004-07-16T04:00:00
Updated: 2017-10-10T00:57:01
Reserved: 2004-06-23T00:00:00
Link: CVE-2004-0595
JSON object: View
NVD Information
Status : Modified
Published: 2004-07-27T04:00:00.000
Modified: 2018-10-30T16:25:35.387
Link: CVE-2004-0595
JSON object: View
Redhat Information
No data.
CWE