CVE-2012-2667: Medium severity SensioLabs Symfony vulnerability
Published Jun 7, 2012
·Updated
Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."
Affected Software
20 affected components
SensioLabs Symfony<=1.4.17
SensioLabs Symfony=1.4.0
SensioLabs Symfony=1.4.0-rc1
SensioLabs Symfony=1.4.0-rc2
SensioLabs Symfony=1.4.1
SensioLabs Symfony=1.4.2
SensioLabs Symfony=1.4.3
SensioLabs Symfony=1.4.4
SensioLabs Symfony=1.4.5
SensioLabs Symfony=1.4.6
SensioLabs Symfony=1.4.7
SensioLabs Symfony=1.4.8
SensioLabs Symfony=1.4.9
SensioLabs Symfony=1.4.10
SensioLabs Symfony=1.4.11
SensioLabs Symfony=1.4.12
SensioLabs Symfony=1.4.13
SensioLabs Symfony=1.4.14
SensioLabs Symfony=1.4.15
SensioLabs Symfony=1.4.16
Event History
Jun 7, 2012
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2667?
CVE-2012-2667 is classified as a medium severity vulnerability due to the potential for session hijacking.
2
How do I fix CVE-2012-2667?
To fix CVE-2012-2667, upgrade SensioLabs Symfony to version 1.4.18 or later.
3
What versions of Symfony are affected by CVE-2012-2667?
CVE-2012-2667 affects SensioLabs Symfony versions up to and including 1.4.17.
4
What type of vulnerability is CVE-2012-2667?
CVE-2012-2667 is a session fixation vulnerability.
5
Can CVE-2012-2667 be exploited remotely?
Yes, CVE-2012-2667 can be exploited remotely to hijack web sessions.