CVE-2010-1130

Summary

CVE	CVE-2010-1130
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2010-03-26 20:30:00 UTC
Updated	2026-04-29 01:13:23 UTC
Description	session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).

Primary CVSS: v2.0 5 from [email protected]

AV:N/AC:L/Au:N/C:N/I:P/A:N

Problem Types: CWE-264 | n/a

Access Vector

Network

Access Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

AV:N/AC:L/Au:N/C:N/I:P/A:N

Type	Vendor	Product	Version	Update	Edition	Language
Application	Php	Php	5.0.0	All	All	All
Application	Php	Php	5.0.0	beta1	All	All
Application	Php	Php	5.0.0	beta2	All	All
Application	Php	Php	5.0.0	beta3	All	All
Application	Php	Php	5.0.0	beta4	All	All
Application	Php	Php	5.0.0	rc1	All	All
Application	Php	Php	5.0.0	rc2	All	All
Application	Php	Php	5.0.0	rc3	All	All
Application	Php	Php	5.0.1	All	All	All
Application	Php	Php	5.0.2	All	All	All
Application	Php	Php	5.0.3	All	All	All
Application	Php	Php	5.0.4	All	All	All
Application	Php	Php	5.0.5	All	All	All
Application	Php	Php	5.1.0	All	All	All
Application	Php	Php	5.1.1	All	All	All
Application	Php	Php	5.1.2	All	All	All
Application	Php	Php	5.1.3	All	All	All
Application	Php	Php	5.1.4	All	All	All
Application	Php	Php	5.1.5	All	All	All
Application	Php	Php	5.1.6	All	All	All
Application	Php	Php	5.2.0	All	All	All
Application	Php	Php	5.2.1	All	All	All
Application	Php	Php	5.2.10	All	All	All
Application	Php	Php	5.2.11	All	All	All
Application	Php	Php	5.2.13	All	All	All
Application	Php	Php	5.2.2	All	All	All
Application	Php	Php	5.2.3	All	All	All
Application	Php	Php	5.2.4	All	All	All
Application	Php	Php	5.2.5	All	All	All
Application	Php	Php	5.2.6	All	All	All
Application	Php	Php	5.2.7	All	All	All
Application	Php	Php	5.2.8	All	All	All
Application	Php	Php	5.2.9	All	All	All
Application	Php	Php	5.3.1	All	All	All
Application	Php	Php	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

Reference	Source	Link	Tags
PHP: PHP 5 ChangeLog	af854a3a-2127-422b-91ae-364da2661108	www.php.net
PHP 5.2.12/5.3.1 session.save_path safe_mode and open_basedir bypass ( Research Advisory ) - SecurityReason.com	af854a3a-2127-422b-91ae-364da2661108	securityreason.com
ViewVC Exception	af854a3a-2127-422b-91ae-364da2661108	svn.php.net
ViewVC Exception	af854a3a-2127-422b-91ae-364da2661108	svn.php.net
ViewVC Exception	af854a3a-2127-422b-91ae-364da2661108	svn.php.net
ViewVC Exception	af854a3a-2127-422b-91ae-364da2661108	svn.php.net
SecurityTracker.com Archives - PHP Bugs Let Local Users Bypass safe_mode and open_basedir Security Controls	af854a3a-2127-422b-91ae-364da2661108	securitytracker.com
PHP 5.2.12/5.3.1 session.save_path safe_mode and open_basedir bypass - SecurityReason.com	af854a3a-2127-422b-91ae-364da2661108	securityreason.com	Exploit
Webmail : Solution de messagerie professionnelle - OVHcloud- OVH	af854a3a-2127-422b-91ae-364da2661108	www.vupen.com	Vendor Advisory
PHP Two Security Bypass Vulnerabilities - Advisories - Community	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
PHP: PHP 5.2.13 Release Announcement	af854a3a-2127-422b-91ae-364da2661108	www.php.net	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Organization	Published	Contributor	Statement
Red Hat	2010-03-27	Vincent Danen	We do not consider safe_mode / open_basedir restriction bypass issues being security sensitive. For more details see http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php

There are currently no legacy QID mappings associated with this CVE.