CVE-2005-4731: Medium severity The PHP Group Pear Html Quickform Controller vulnerability

Published Dec 31, 2005

Updated

The Next action in PEAR HTMLQuickFormController 1.0.4 includes the SID in the URL even when session.useonlycookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.

Affected Software

1 affected component

The PHP Group Pear Html Quickform Controller=1.0.4

Event History

Dec 31, 2005

CVE Published

05:00 AM

Mar 15, 2006

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2005-4731?

The severity of CVE-2005-4731 is classified as medium risk due to the potential exposure of sensitive session identifiers.

How do I fix CVE-2005-4731?

To fix CVE-2005-4731, upgrade to a version of PEAR HTML_QuickForm_Controller that is not affected by this vulnerability.

What is affected by CVE-2005-4731?

CVE-2005-4731 specifically affects PEAR HTML_QuickForm_Controller version 1.0.4.

What are the risks associated with CVE-2005-4731?

The risks associated with CVE-2005-4731 include the possible exposure of session identifiers through HTTP Referer headers, leading to session hijacking.

Can I prevent CVE-2005-4731 from occurring?

Preventing CVE-2005-4731 involves ensuring that session identifiers are not disclosed in URLs through proper configuration and maintaining updated software.