Vulnetix
Try Vulnetix Request Demo
CVE-2010-1130 PUBLISHED CVSS 5 MEDIUM

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).

EPSS 5.57% · 90.2th percentile

Risk Scores

CVSS v2.0
5
EPSS Score
5.57%
90.2th percentile

Affected Products

VendorProductVersions
phpphp5.3.1, 0, 5.0.0
n/an/an/a

Timeline

References

Open in Interactive Console →