Description

The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PS_UNDEF_MARKER marker, which allows context-dependent attackers to modify arbitrary session variables via a crafted session variable name.

Remediation

References

CVE-2010-3065

Related Vulnerabilities

WordPress Deserialization of Untrusted Data Vulnerability (CVE-2018-19296)

WordPress Plugin Wu-Rating Cross-Site Scripting (1.0 12319)

WordPress Plugin Contact Form by BestWebSoft Cross-Site Scripting (4.0.1)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-2154)

concrete5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-2250)

Severity

Medium

Classification

CVE-2010-3065 CWE-264

Tags

Missing Update Known Vulnerabilities