NVD

Id
53881  
Name
CVE-2007-1701  
Description
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:".  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-03-26  
Modified Date
2012-11-05  
Seq
2007-1701  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
273180 53881 CVE-2007-1701 HPSBMA02215  View
273181 53881 CVE-2007-1701 HPSBTU02232  View
273182 53881 CVE-2007-1701 oval:org.mitre.oval:def:11034  View
273183 53881 CVE-2007-1701 GLSA-200705-19  View
273184 53881 CVE-2007-1701 http://www.php-security.org/MOPB/MOPB-31-2007.html  View
273185 53881 CVE-2007-1701 23120  View
273186 53881 CVE-2007-1701 ADV-2007-1991  View
273187 53881 CVE-2007-1701 ADV-2007-2374  View
273188 53881 CVE-2007-1701 php-sessiondecode-code-execution(33658)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
51852 JVNDB-2007-000515 PHP の register_globals の有効な環境下において任意のコードを実行される脆弱性 PHP の register_globals が有効である環境下では _SESSION 配列の処理に不備が存在するために、任意のグローバル変数を上書き可能となり、任意のコードを実行される脆弱性が存在します。 CVE-2007-1701 25056 CVE-2007-1701 53881 6.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000515.html 2007-02-19 2007-07-23 View