PT-2013-1331 · Php · Php
Yohgaki
·
Publicado
2013-08-13
·
Atualizado
2024-06-15
·
CVE-2011-4718
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.5.2
Description
The issue is related to a session fixation vulnerability in the Sessions subsystem, allowing remote attackers to hijack web sessions by specifying a session ID. This is also associated with errors in privilege management, which can be exploited by a remote attacker to capture a user's session.
Recommendations
For versions prior to 5.5.2, update to version 5.5.2 or later to resolve the issue. As a temporary workaround, consider implementing additional session validation and regeneration mechanisms to minimize the risk of session hijacking. Restrict access to sensitive session data to prevent exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Php