Session Management Flaw in Zend Framework by Zend
CVE-2015-1555

9.1CRITICAL

Key Information:

Vendor

Zend

Status
Zend Framework
Vendor
CVE Published:
7 August 2017
đź”” Create Zend Vulnerability Alert

What is CVE-2015-1555?

The vulnerability in Zend Framework affects session management by allowing remote attackers to create valid sessions without the use of session validators. This flaw exists in versions 2.2.x before 2.2.9 and 2.3.x before 2.3.4, posing a risk of unauthorized access and manipulation of session-based data. Security best practices should be employed to mitigate the risks associated with this vulnerability.

References

http://framework.zend.com/security/advisory/ZF2015-01
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.