CVE-2010-3065: Medium severity PHP PHP vulnerability

Published Aug 20, 2010

Updated

The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PSUNDEFMARKER marker, which allows context-dependent attackers to modify arbitrary session variables via a crafted session variable name.

Affected Software

17 affected components

PHP PHP=5.2.9

PHP PHP=5.3.1

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.2.5

PHP PHP=5.2.12

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.3.0

PHP PHP=5.2.3

PHP PHP=5.2.13

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.3.2

PHP PHP=5.2.10

PHP PHP=5.2.1

PHP PHP=5.2.8

Event History

Aug 20, 2010

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3065?

CVE-2010-3065 is considered a moderate severity vulnerability due to its potential to allow attackers to modify session variables.

How do I fix CVE-2010-3065?

To fix CVE-2010-3065, upgrade your PHP version to 5.3.3 or later, as the vulnerability has been rectified in those versions.

Which versions of PHP are affected by CVE-2010-3065?

CVE-2010-3065 affects PHP versions 5.2.0 through 5.2.13 and 5.3.0 through 5.3.2.

What type of attack is possible with CVE-2010-3065?

CVE-2010-3065 allows context-dependent attackers to inject arbitrary session data by manipulating the session variable name.

Is CVE-2010-3065 still a concern for current PHP installations?

CVE-2010-3065 is not a concern for current PHP installations if they are updated to versions beyond 5.3.2.