CVE-2015-1555: Input Validation
Published Aug 7, 2017
·Updated
Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.
Affected Software
13 affected components
VMware Spring Framework=2.2.0
VMware Spring Framework=2.2.1
VMware Spring Framework=2.2.2
VMware Spring Framework=2.2.3
VMware Spring Framework=2.2.4
VMware Spring Framework=2.2.5
VMware Spring Framework=2.2.6
VMware Spring Framework=2.2.7
VMware Spring Framework=2.2.8
VMware Spring Framework=2.3.0
VMware Spring Framework=2.3.1
VMware Spring Framework=2.3.2
VMware Spring Framework=2.3.3
Event History
Aug 7, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1555?
CVE-2015-1555 is considered a high severity vulnerability due to its potential to allow unauthorized session creation.
2
How do I fix CVE-2015-1555?
To fix CVE-2015-1555, upgrade Zend Framework to version 2.2.9 or 2.3.4 or later.
3
What impact does CVE-2015-1555 have on my application?
CVE-2015-1555 allows attackers to create valid sessions, potentially leading to session hijacking and unauthorized access.
4
Which versions of Zend Framework are affected by CVE-2015-1555?
CVE-2015-1555 affects Zend Framework versions 2.2.0 to 2.2.8 and 2.3.0 to 2.3.3.
5
Is CVE-2015-1555 a remote vulnerability?
Yes, CVE-2015-1555 can be exploited by remote attackers without needing local access.