CVE-2016-4309 Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter.
HighCVSS 7.5
EPSS 10.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getsymphony symphony | = 2.6.7 | No fix listed |
References
- hyp3rlinx.altervista.org third-party-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20160620 Symphony CMS v2.6.7 Session Fixation mailing-list third-party-advisory vdb-entry
- 91299 third-party-advisory vdb-entry
- github.com third-party-advisory
- 39983 exploit third-party-advisory vdb-entry