Input validation error in Symfony - CVE-2012-2667
Published: June 7, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU44012
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-2667
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."
Affected software
Symfony
Fedora
php-symfony-symfony
Fedora
php-symfony-symfony
How to mitigate CVE-2012-2667
Install update from vendor's website.
php-symfony-symfony - update to 1.4.18-1.el6
External References
- http://secunia.com/advisories/49312
- http://symfony.com/blog/security-release-symfony-1-4-18-released
- http://trac.symfony-project.org/browser/tags/RELEASE_1_4_18/CHANGELOG
- http://www.openwall.com/lists/oss-security/2012/06/04/1
- http://www.openwall.com/lists/oss-security/2012/06/05/2
- http://www.securityfocus.com/bid/53776
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76027