Description
Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."
References
- [oss-security] 20120604 CVE Request -- Symfony / php-symfony-symfony: Session fixation flaw corrected in upstream 1.4.18 version mailing-list
- http://trac.symfony-project.org/browser/tags/RELEASE_1_4_18/CHANGELOG
- 53776 vdb-entry
- http://symfony.com/blog/security-release-symfony-1-4-18-released
- [oss-security] 20120605 Re: CVE Request -- Symfony / php-symfony-symfony: Session fixation flaw corrected in upstream 1.4.18 version mailing-list
- 49312 third-party-advisory
- symfony-session-hijacking(76027) vdb-entry