Unscored severity · published Jun 7, 2012
CVE-2012-2667
Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Symfony · Sensiolabs
through 1.4.17; 1.4.0; 1.4.0; 1.4.0; 1.4.1; 1.4.2; +14 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2667
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2667
Vendor Advisory
http://secunia.com/advisories/49312
Vendor Advisory
http://symfony.com/blog/security-release-symfony-1-4-18-released
trac.symfony-project.org
http://trac.symfony-project.org/browser/tags/RELEASE_1_4_18/CHANGELOG
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/06/04/1
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/06/05/2
www.securityfocus.com
http://www.securityfocus.com/bid/53776
More from Symfony
9.8
CVE-2026-47767
Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
9.8
CVE-2024-51736
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes
9.8
CVE-2019-18889
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7
9.8
CVE-2019-11325
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8
9.8
CVE-2017-11365
Certain Symfony products are affected by: Incorrect Access Control