CVE-2007-4652: Medium severity PHP PHP vulnerability
Published Sep 4, 2007
·Updated
The session extension in PHP before 5.2.4 might allow local users to bypass openbasedir restrictions via a session file that is a symlink.
Affected Software
88 affected components
PHP PHP=4.3.9
PHP PHP=4.4.9
PHP PHP=3.0
PHP PHP=4.0-beta1
PHP PHP=3.0.5
PHP PHP=3.0.11
PHP PHP=5.1.5
PHP PHP=5.1.2
PHP PHP=4.0-beta4
PHP PHP=4.2.0
PHP PHP=5.1.1
PHP PHP=3.0.1
PHP PHP=3.0.2
PHP PHP=4.4.4
PHP PHP=5.0.0-beta1
PHP PHP=4.1.0
PHP PHP=5.1.6
PHP PHP=4.3.4
PHP PHP=4.0.4
PHP PHP=4.3.0
PHP PHP=4.0.5
PHP PHP=5.2.2
PHP PHP=3.0.8
PHP PHP<=5.2.3
PHP PHP=5.0.5
PHP PHP=4.3.6
PHP PHP=3.0.13
PHP PHP=5.0.1
PHP PHP=5.1.4
PHP PHP=4.3.7
PHP PHP=5.0.4
PHP PHP=4.2.2
PHP PHP=4.4.2
PHP PHP=3.0.7
PHP PHP=4.3.2
PHP PHP=4.3.11
PHP PHP=4.0.0
PHP PHP=3.0.6
PHP PHP=3.0.17
PHP PHP=4.0.7
PHP PHP=4.0.2
PHP PHP=4.3.3
PHP PHP=2.0
PHP PHP=4.1.1
PHP PHP=3.0.15
PHP PHP=3.0.16
PHP PHP=4.4.3
PHP PHP=5.0.0-rc2
PHP PHP=5.0.3
PHP PHP=3.0.10
PHP PHP=3.0.4
PHP PHP=4.2.3
PHP PHP=5.1.0
PHP PHP=4.4.5
PHP PHP=5.0.0-rc3
PHP PHP=4.0-beta2
PHP PHP=2.0b10
PHP PHP=4.4.8
PHP PHP=4.0.6
PHP PHP=5.2.0
PHP PHP=4.1.2
PHP PHP=5.0.0-beta3
PHP PHP=4.3.1
PHP PHP=5.1.3
PHP PHP=3.0.18
PHP PHP=4.0-beta_4_patch1
PHP PHP=4.4.0
PHP PHP=4.3.10
PHP PHP=4.2.1
PHP PHP=5.0.0-rc1
PHP PHP=4.0.1
PHP PHP=1.0
PHP PHP=5.0.2
PHP PHP=4.4.6
PHP PHP=3.0.12
PHP PHP=4.4.1
PHP PHP=4.0-beta3
PHP PHP=5.2.1
PHP PHP=4.0.3
PHP PHP=3.0.14
PHP PHP=3.0.9
PHP PHP=3.0.3
PHP PHP=5.0.0-beta4
PHP PHP=5.0.0
PHP PHP=4.3.8
PHP PHP=4.3.5
PHP PHP=5.0.0-beta2
PHP PHP=4.4.7
Remediation
Patch Available
Event History
Sep 4, 2007
CVE Published
07:17 PM
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-4652?
CVE-2007-4652 has a moderate severity rating allowing potential local user access violations.
2
How do I fix CVE-2007-4652?
Upgrade your PHP version to 5.2.4 or later to mitigate CVE-2007-4652.
3
What versions of PHP are affected by CVE-2007-4652?
CVE-2007-4652 affects multiple PHP versions including 3.x, 4.x, and versions up to 5.2.3.
4
Can CVE-2007-4652 be exploited remotely?
No, CVE-2007-4652 can only be exploited by local users.
5
What is the potential impact of CVE-2007-4652 if exploited?
If exploited, CVE-2007-4652 allows local users to bypass open_basedir restrictions, potentially leading to unauthorized file access.