blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2011-4718

MEDIUM 6.8 CVSS 2.0
Published
August 13, 2013
Last modified
June 16, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-264
CVSS vector
AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.

Affected products and versions

  • PHP — Up to and including 5.5.1
  • PHP versions 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.2.14, 5.2.15, 5.2.16, 5.2.17, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.3.7, 5.3.8, 5.3.9, 5.3.10, 5.3.11, 5.3.12, 5.3.13, 5.3.14, 5.3.15, 5.3.16, 5.3.17, 5.3.18, 5.3.19, 5.3.20, 5.3.21, 5.3.22, 5.3.23, 5.3.24, 5.3.25, 5.3.26, 5.3.27, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.4.7, 5.4.8, 5.4.9, 5.4.10, 5.4.11, 5.4.12, 5.4.12rc1, 5.4.12rc2, 5.4.13, 5.4.13rc1, 5.4.14, 5.4.14rc1, 5.4.15rc1, 5.4.16rc1, 5.5.0alpha1, 5.5.0alpha2, 5.5.0alpha3, 5.5.0alpha4, 5.5.0alpha5, 5.5.0alpha6, 5.5.0beta1, 5.5.0beta2, 5.5.0beta3, 5.5.0beta4, 5.5.0rc1, 5.5.0rc2

References

  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=169b78eb79b0e080b67f9798708eb3771c6d0b2f
  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=25e8fcc88fa20dc9d4c47184471003f436927cde
  • bugs.php.net https://bugs.php.net/bug.php?id=60491
  • wiki.php.net https://wiki.php.net/rfc/strict_sessions
  • nvd.nist.gov Official NVD record