CVE-2006-3016

Advisory lineage Upstream: 0 Downstream: 1

Downstream

RHSA-2006:0669

Modified

Published: 14 Jun 2006, 23:00

Last modified:07 Aug 2024, 18:16

Vulnerability Summary

Overall Risk (default)

high

70/100

CVSS Score

9.3 HIGH

v2.0 (nvd)

EPSS Score

6.74% LOW

7% probability 0.00%

KEV

Not listed

Ransomware

No reports

Public exploits

1 found

Dark Web

Not detected

Timeline

14 Jun 2006, 23:00

Published

Vulnerability first disclosed

07 Aug 2024, 18:16

Last Modified

Vulnerability information updated

Description

Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().

CVSS Metrics

v2.0•HIGH•Score: 9.3AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 6.74%• Percentile: 91%

Affected Systems

Unknown•PHP
≤ 5.1.2