Lucene search

MitreCVE-2005-4731

HistoryMar 15, 2006 - 5:00 p.m.

CVE-2005-4731

2006-03-1517:00:00

mitre

web.nvd.nist.gov

cve-2005-4731

pear

html_quickform_controller

security vulnerability

session hijacking

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.006

Percentile

78.4%

JSON

The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.

Affected configurations

Nvd

Node

the_php_grouppear_html_quickform_controllerMatch1.0.4

VendorProductVersionCPE
the_php_grouppear_html_quickform_controller1.0.4cpe:2.3:a:the_php_group:pear_html_quickform_controller:1.0.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
the_php_group	pear_html_quickform_controller	1.0.4	cpe:2.3:a:the_php_group:pear_html_quickform_controller:1.0.4:::::::*

References

pear.php.net/bugs/bug.php?id=3443

pear.php.net/package/HTML_QuickForm_Controller/download

www.osvdb.org/23766

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.006

Percentile

78.4%

JSON

Related for CVE-2005-4731