CVE-2007-3378: Medium severity PHP PHP vulnerability
The (1) sessionsavepath, (2) iniset, and (3) errorlog functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safemode and openbasedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) phpvalue, (b) phpflag, and (c) directives in .htaccess.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3378?
CVE-2007-3378 is considered a high severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2007-3378?
To fix CVE-2007-3378, upgrade PHP to version 5.2.4 or later, or to a version 4.4.8 or later.
What versions of PHP are affected by CVE-2007-3378?
CVE-2007-3378 affects PHP versions 4.4.7 and earlier, as well as 5.2.3 and earlier.
What types of attacks can be carried out due to CVE-2007-3378?
CVE-2007-3378 allows remote attackers to bypass safe_mode and open_basedir restrictions, potentially executing arbitrary commands.
What functions in PHP are related to CVE-2007-3378?
The functions session_save_path, ini_set, and error_log are related to CVE-2007-3378 when invoked from a .htaccess file.