NVD

Id
44385  
Name
CVE-2012-2667  
Description
Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2012-06-07  
Modified Date
2012-06-08  
Seq
2012-2667  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
222641 44385 CVE-2012-2667 http://symfony.com/blog/security-release-symfony-1-4-18-released  View
222642 44385 CVE-2012-2667 http://trac.symfony-project.org/browser/tags/RELEASE_1_4_18/CHANGELOG  View
222643 44385 CVE-2012-2667 [oss-security] 20120604 CVE Request -- Symfony / php-symfony-symfony: Session fixation flaw corrected in upstream 1.4.18 version  View
222644 44385 CVE-2012-2667 [oss-security] 20120605 Re: CVE Request -- Symfony / php-symfony-symfony: Session fixation flaw corrected in upstream 1.4.18 version  View
222645 44385 CVE-2012-2667 53776  View
222646 44385 CVE-2012-2667 symfony-session-hijacking(76027)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
26938 JVNDB-2012-002645 SensioLabs Symfony における Web セッションをハイジャックされる脆弱性 SensioLabs Symfony の lib/user/sfBasicSecurityUser.class.php には、regenerate() メソッドおよび不特定の "データベースを支援するセッションクラス (database backed session class)" の処理に不備があるため、Web セッションをハイジャックされる脆弱性が存在します。 CVE-2012-2667 55905 CVE-2012-2667 44385 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002645.html 2012-06-07 2012-06-11 View