VULNERABILITY INTELLIGENCE
CVE-2007-1701
CVSS score6.8 MEDIUM
EPSS probability9.23%
CISA KEVNot currently listed
Published2007-03-27
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P
Description
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:".
Weakness classification
- CWE-502: Deserialization of Untrusted Data
Primary references
- cve@mitre.org — Broken Link
- cve@mitre.org — Broken Link
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Third Party Advisory