Session Validation Bypass

2017-08-0806:07:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

70.9%

JSON

Zendframwork is vulnerable to session validation bypass. If the session validator is set up prior to the start of a session, it will not have any validator metadata attached, causing the application to rebuild the metadata and mark the current session as valid.

CPENameOperatorVersion
zendframework/zendframeworkle2.2.8
zendframework/zendframeworkle2.3.3

CPE	Name	Operator	Version
	zendframework/zendframework	le	2.2.8
	zendframework/zendframework	le	2.3.3

References

framework.zend.com/security/advisory/ZF2015-01

github.com/zendframework/zendframework/issues/6366

github.com/zendframework/zendframework/pull/7094

0.003 Low

EPSS

Percentile

70.9%

JSON

Related for VERACODE:4886