CVE-2011-4718: Medium severity php vulnerability
Published Aug 13, 2013
·Updated
Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.
Affected Software
100 affected components
PHP PHP<=5.5.1
PHP PHP=5.0.0
PHP PHP=5.0.0-beta1
PHP PHP=5.0.0-beta2
PHP PHP=5.0.0-beta3
PHP PHP=5.0.0-beta4
PHP PHP=5.0.0-rc1
PHP PHP=5.0.0-rc2
PHP PHP=5.0.0-rc3
PHP PHP=5.0.1
PHP PHP=5.0.2
PHP PHP=5.0.3
PHP PHP=5.0.4
PHP PHP=5.0.5
PHP PHP=5.1.0
PHP PHP=5.1.1
PHP PHP=5.1.2
PHP PHP=5.1.3
PHP PHP=5.1.4
PHP PHP=5.1.5
PHP PHP=5.1.6
PHP PHP=5.2.0
PHP PHP=5.2.1
PHP PHP=5.2.2
PHP PHP=5.2.3
PHP PHP=5.2.4
PHP PHP=5.2.5
PHP PHP=5.2.6
PHP PHP=5.2.7
PHP PHP=5.2.8
PHP PHP=5.2.9
PHP PHP=5.2.10
PHP PHP=5.2.11
PHP PHP=5.2.12
PHP PHP=5.2.13
PHP PHP=5.2.14
PHP PHP=5.2.15
PHP PHP=5.2.16
PHP PHP=5.2.17
PHP PHP=5.3.0
PHP PHP=5.3.1
PHP PHP=5.3.2
PHP PHP=5.3.3
PHP PHP=5.3.4
PHP PHP=5.3.5
PHP PHP=5.3.6
PHP PHP=5.3.7
PHP PHP=5.3.8
PHP PHP=5.3.9
PHP PHP=5.3.10
PHP PHP=5.3.11
PHP PHP=5.3.12
PHP PHP=5.3.13
PHP PHP=5.3.14
PHP PHP=5.3.15
PHP PHP=5.3.16
PHP PHP=5.3.17
PHP PHP=5.3.18
PHP PHP=5.3.19
PHP PHP=5.3.20
PHP PHP=5.3.21
PHP PHP=5.3.22
PHP PHP=5.3.23
PHP PHP=5.3.24
PHP PHP=5.3.25
PHP PHP=5.3.26
PHP PHP=5.3.27
PHP PHP=5.4.0
PHP PHP=5.4.1
PHP PHP=5.4.2
PHP PHP=5.4.3
PHP PHP=5.4.4
PHP PHP=5.4.5
PHP PHP=5.4.6
PHP PHP=5.4.7
PHP PHP=5.4.8
PHP PHP=5.4.9
PHP PHP=5.4.10
PHP PHP=5.4.11
PHP PHP=5.4.12
PHP PHP=5.4.12-rc1
PHP PHP=5.4.12-rc2
PHP PHP=5.4.13
PHP PHP=5.4.13-rc1
PHP PHP=5.4.14
PHP PHP=5.4.14-rc1
PHP PHP=5.4.15-rc1
PHP PHP=5.4.16-rc1
PHP PHP=5.5.0-alpha1
PHP PHP=5.5.0-alpha2
PHP PHP=5.5.0-alpha3
PHP PHP=5.5.0-alpha4
PHP PHP=5.5.0-alpha5
PHP PHP=5.5.0-alpha6
PHP PHP=5.5.0-beta1
PHP PHP=5.5.0-beta2
PHP PHP=5.5.0-beta3
PHP PHP=5.5.0-beta4
PHP PHP=5.5.0-rc1
PHP PHP=5.5.0-rc2
Remediation
Event History
Aug 13, 2013
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-4718?
CVE-2011-4718 is categorized as a high severity vulnerability due to its potential to allow session hijacking.
2
How do I fix CVE-2011-4718?
To mitigate CVE-2011-4718, upgrade PHP to version 5.5.2 or later where the vulnerability is addressed.
3
Who is affected by CVE-2011-4718?
CVE-2011-4718 affects all PHP versions prior to 5.5.2, including 5.5.1 and earlier versions.
4
What is the impact of CVE-2011-4718?
The impact of CVE-2011-4718 is that attackers can hijack user sessions by controlling session ID values.
5
Is there a workaround for CVE-2011-4718?
A workaround for CVE-2011-4718 is to implement server-side validation of session IDs, but upgrading PHP is the recommended approach.