CVE-2007-2546 : Session fixation vulnerability in Simple Machines Forum (SMF) 1.1.2 and earlier

Session fixation vulnerability in Simple Machines Forum (SMF) 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

Published 2007-05-09 10:19:00

Updated 2025-04-09 00:30:58

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2007-2546

Simple Machines » Simple Machines Forum
Versions up to, including, (<=) 1.1.2
cpe:2.3:a:simple_machines:simple_machines_forum:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2007-2546

EPSS FAQ

0.83%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 72 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2007-2546

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2007-2546

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2007-2546

Jump to

Vulnerability Details : CVE-2007-2546

Products affected by CVE-2007-2546

Exploit prediction scoring system (EPSS) score for CVE-2007-2546

CVSS scores for CVE-2007-2546

CWE ids for CVE-2007-2546

References for CVE-2007-2546