NVD

Id
61700  
Name
CVE-2006-3016  
Description
Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2016-12-20  
Published
2006-06-14  
Modified Date
2010-09-15  
Seq
2006-3016  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
319360 61700 CVE-2006-3016 20061001-01-P  View
319361 61700 CVE-2006-3016 oval:org.mitre.oval:def:10597  View
319362 61700 CVE-2006-3016 RHSA-2006:0736  View
319363 61700 CVE-2006-3016 1016306  View
319364 61700 CVE-2006-3016 http://support.avaya.com/elmodocs2/security/ASA-2006-221.htm  View
319365 61700 CVE-2006-3016 http://support.avaya.com/elmodocs2/security/ASA-2006-222.htm  View
319366 61700 CVE-2006-3016 MDKSA-2006:122  View
319367 61700 CVE-2006-3016 http://www.php.net/release_5_1_3.php  View
319368 61700 CVE-2006-3016 RHSA-2006:0669  View
319369 61700 CVE-2006-3016 RHSA-2006:0682  View
319370 61700 CVE-2006-3016 20061005 rPSA-2006-0182-1 php php-mysql php-pgsql  View
319371 61700 CVE-2006-3016 17843  View
319372 61700 CVE-2006-3016 TLSA-2006-38  View
319373 61700 CVE-2006-3016 USN-320-1  View
319374 61700 CVE-2006-3016 https://issues.rpath.com/browse/RPL-683  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
58057 JVNDB-2006-000253 PHP の session.c におけるクロスサイトスクリプティングの脆弱性 PHP のセッションの初期化に関連する処理において、セッション名に使用される特定の文字に対するチェックが不適切であるため、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2006-3016 19118 CVE-2006-3016 61700 9.3 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-000253.html 2006-05-01 2007-04-01 View