7.5

CVE-2006-4433

PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file.  NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Php ≫ Php Version 4.0
Php ≫ Php Version 4.0 Update beta_4_patch1
Php ≫ Php Version 4.0 Update beta1
Php ≫ Php Version 4.0 Update beta2
Php ≫ Php Version 4.0 Update beta3
Php ≫ Php Version 4.0 Update beta4
Php ≫ Php Version 4.0 Update rc1
Php ≫ Php Version 4.0 Update rc2
Php ≫ Php Version 4.0.0
Php ≫ Php Version 4.0.1
Php ≫ Php Version 4.0.1 Update patch1
Php ≫ Php Version 4.0.1 Update patch2
Php ≫ Php Version 4.0.2
Php ≫ Php Version 4.0.3
Php ≫ Php Version 4.0.3 Update patch1
Php ≫ Php Version 4.0.4
Php ≫ Php Version 4.0.4 Update patch1
Php ≫ Php Version 4.0.5
Php ≫ Php Version 4.0.6
Php ≫ Php Version 4.0.7
Php ≫ Php Version 4.0.7 Update rc1
Php ≫ Php Version 4.0.7 Update rc2
Php ≫ Php Version 4.0.7 Update rc3
Php ≫ Php Version 4.1.0
Php ≫ Php Version 4.1.1
Php ≫ Php Version 4.1.2
Php ≫ Php Version 4.2 Edition dev
Php ≫ Php Version 4.2.0
Php ≫ Php Version 4.2.1
Php ≫ Php Version 4.2.2
Php ≫ Php Version 4.2.3
Php ≫ Php Version 4.3.0
Php ≫ Php Version 4.3.1
Php ≫ Php Version 4.3.2
Php ≫ Php Version 4.3.3
Php ≫ Php Version 4.3.4
Php ≫ Php Version 4.3.5
Php ≫ Php Version 4.3.6
Php ≫ Php Version 4.3.7
Php ≫ Php Version 4.3.8
Php ≫ Php Version 4.3.9
Php ≫ Php Version 4.3.10
Php ≫ Php Version 4.3.11
Php ≫ Php Version 4.4.0
Php ≫ Php Version 4.4.1
Php ≫ Php Version 4.4.2
Php ≫ Php Version 5.0 Update rc1
Php ≫ Php Version 5.0 Update rc2
Php ≫ Php Version 5.0 Update rc3
Php ≫ Php Version 5.0.0
Php ≫ Php Version 5.0.0 Update beta1
Php ≫ Php Version 5.0.0 Update beta2
Php ≫ Php Version 5.0.0 Update beta3
Php ≫ Php Version 5.0.0 Update beta4
Php ≫ Php Version 5.0.0 Update rc1
Php ≫ Php Version 5.0.0 Update rc2
Php ≫ Php Version 5.0.0 Update rc3
Php ≫ Php Version 5.0.1
Php ≫ Php Version 5.0.2
Php ≫ Php Version 5.0.3
Php ≫ Php Version 5.0.4
Php ≫ Php Version 5.0.5
Php ≫ Php Version 5.1.0
Php ≫ Php Version 5.1.1
Php ≫ Php Version 5.1.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.79% 0.761
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://secunia.com/advisories/21573
Patch
Vendor Advisory
http://securityreason.com/securityalert/1466
http://www.hardened-php.net/advisory_052006.128.html
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/444263/100/0/threaded
http://www.vupen.com/english/advisories/2006/3388
http://www.osvdb.org/28233
http://www.osvdb.org/28273