Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2007-3799
HistoryJul 16, 2007 - 10:30 p.m.

CVE-2007-3799

2007-07-1622:30:00
CWE-20
[email protected]
web.nvd.nist.gov
57
php
session_start
cve-2007-3799
vulnerability
security
remote attackers

6.5 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.147 Low

EPSS

Percentile

95.7%

JSON

The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207.

References

Related

ubuntucve 2
prion 2
veracode 1
openvas 16
redhat 5
nessus 28
osv 3
debian 4
centos 3
cve 1
fedora 1
oraclelinux 2
gentoo 1
ubuntu 3
f5 2
securityvulns 1
ubuntucve
ubuntucve
CVE-2007-3799
2007-07-16 00:00:00
CVE-2006-0207
2006-01-13 00:00:00
prion
prion
Sql injection
2007-07-16 22:30:00
Design/Logic Flaw
2006-01-13 23:03:00
veracode
veracode
Improper Session Handling
2020-04-10 00:18:57
openvas
openvas
Debian Security Advisory DSA 1578-1 (php4)
2008-05-27 00:00:00
SLES9: Security update for PHP4
2009-10-10 00:00:00
Fedora Update for php FEDORA-2007-709
2009-02-27 00:00:00
redhat
redhat
(RHSA-2007:0888) Moderate: php security update
2007-10-23 00:00:00
(RHSA-2007:0890) Moderate: php security update
2007-09-20 00:00:00
(RHSA-2007:0917) Moderate: php security update
2007-10-23 00:00:00
nessus
nessus
RHEL 2.1 : php (RHSA-2007:0888)
2007-10-25 00:00:00
Debian DSA-1578-1 : php4 - several vulnerabilities
2008-05-19 00:00:00
SuSE9 Security Update : PHP4 (YOU Patch Number 11666)
2009-09-24 00:00:00
osv
osv
php4 - several vulnerabilities
2008-05-17 00:00:00
php5 several issues
2008-01-23 00:00:00
php4 - several vulnerabilities
2007-07-07 00:00:00
debian
debian
[SECURITY] [DSA 1578-1] New php4 packages fix several vulnerabilities
2008-05-17 11:44:14
[SECURITY] [DSA 1444-1] New php5 packages fix several vulnerabilities
2008-01-03 20:25:59
[SECURITY] [DSA 1444-2] New php5 packages fix regression
2008-01-23 21:29:45
centos
centos
php security update
2007-10-24 03:08:58
php security update
2007-09-20 14:31:37
php security update
2007-09-26 09:03:28
cve
cve
CVE-2006-0207
2006-01-13 23:03:00
fedora
fedora
[SECURITY] Fedora Core 6 Update: php-5.1.6-3.7.fc6
2007-09-24 20:33:40
oraclelinux
oraclelinux
Moderate: php security update
2007-09-26 00:00:00
Moderate: php security update
2007-09-20 00:00:00
gentoo
gentoo
PHP: Format string and XSS vulnerabilities
2006-03-22 00:00:00
ubuntu
ubuntu
PHP vulnerabilities
2006-03-10 00:00:00
PHP vulnerabilities
2007-11-29 00:00:00
PHP regression
2007-12-03 00:00:00
f5
f5
SOL13519 - Multiple PHP vulnerabilities
2012-04-04 00:00:00
K13519 : Multiple PHP vulnerabilities
2013-09-20 00:00:00
securityvulns
securityvulns
PHP multiple security vulnerabilities
2008-01-04 00:00:00

6.5 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.147 Low

EPSS

Percentile

95.7%

JSON
Related for CVE-2007-3799
ubuntucve2prion2veracode1openvas16redhat5nessus28osv3debian4centos3cve1fedora1oraclelinux2gentoo1ubuntu3f52securityvulns1