VULNERABILITY INTELLIGENCE

CVE-2009-0754

CVSS score2.1 LOW
EPSS probability0.95%
CISA KEVNot currently listed
Published2009-03-03
Last modified2026-06-16
CVSS vectorAV:L/AC:L/Au:N/C:N/I:P/A:N

Description

PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.

Weakness classification

  • CWE-134: Use of Externally-Controlled Format String

Primary references