Home > Vulnerability Database > CVE-2007-4652

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2007-4652

Date: September 4, 2007

The session extension in PHP before 5.2.4 might allow local users to bypass open_basedir restrictions via a session file that is a symlink.

Severity Score

4.9

Related Resources (15)

Url: http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/36387

Url: http://www.php.net/ChangeLog-5.php#5.2.4

Url: http://www.vupen.com/english/advisories/2007/3023

Url: http://www.trustix.org/errata/2007/0026/

Url: https://issues.rpath.com/browse/RPL-1693

Url: http://secunia.com/advisories/26822

Url: https://nvd.nist.gov/vuln/detail/CVE-2007-4652

Url: http://secunia.com/advisories/26838

Url: https://issues.rpath.com/browse/RPL-1702

Url: http://secunia.com/advisories/27377

Url: http://secunia.com/advisories/27102

Url: http://www.php.net/releases/5_2_4.php

Url: http://secunia.com/advisories/26642

Url: https://www.mend.io/vulnerability-database/CVE-2007-4652

Severity Score

4.9

Weakness Type (CWE)

Link Following

CWE-59

CVSS v3.1

Base Score:	4.9
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	4.4
Access Vector (AV):	LOCAL
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Do you need more information?

Contact Us