Package(s):	PHP	CVE #(s):	CAN-2003-0442
Created:	July 2, 2003	Updated:	August 13, 2003
Description:	In PHP version 4.3.1 and earlier, when transparent session ID support is enabled using the "session.use_trans_sid" option, the session ID is not escaped before use. This allows a Cross Site Scripting attack.
Alerts:	Mandrake MDKSA-2003:082-1 php 2003-08-12 Mandrake MDKSA-2003:082 php 2003-08-04 Yellow Dog YDU-20030710-2 php 2003-07-10 Debian DSA-351-1 php4 2003-07-16 Conectiva CLA-2003:691 php4 2003-07-08 OpenPKG OpenPKG-SA-2003.032 php, apache 2003-07-07 Red Hat RHSA-2003:204-01 PHP 2003-07-02

---

to post comments