{"action":"Upgrade zendframework/zend-session to 2.2.9 or later.","affected":[{"fixed":"2.2.9","introduced":"2.0.0"},{"fixed":"2.3.4","introduced":"2.3.0"}],"component":"zendframework/zend-session","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.2.9","2.3.4"],"ghsa_id":"GHSA-96c6-m98x-hxjx","id":"tcs_01M5KEZQQBS0MRMY9S78PG48KD","modified_at":"2024-12-04T05:40:26.255578Z","published_at":"2024-06-07T21:25:23Z","references":["https://osv.dev/vulnerability/GHSA-96c6-m98x-hxjx","https://github.com/zendframework/zend-session/commit/05fa95488b5ade513c4dcc56051a7ddb1c94f341","https://github.com/zendframework/zend-session/commit/1272fc047121720130690c324413629d8f63d210","https://github.com/zendframework/zend-session/commit/35014ab0ae17c2a169320f182697ee9fe73d841e","https://github.com/zendframework/zend-session/commit/3b1a65b3193a4219f5c4259ab8735f9ad254a021","https://github.com/zendframework/zend-session/commit/6a27a9fddd8f5b12b3af0de6309181ff5946dd0e","https://github.com/zendframework/zend-session/commit/7c4b73dd64e01001946aac76c6deddfe1c6ef0be","https://github.com/zendframework/zend-session/commit/7fc94bd6a60342416242a3899d63072c471b33d3","https://github.com/zendframework/zend-session/commit/93b43aa0ca5348d29034f67195ffa3f4082878d5","https://github.com/zendframework/zend-session/commit/9868f84513536446b0bac81cc95e0130b0a6fc9c","https://github.com/zendframework/zend-session/commit/a3382bfd3067f527762294b5fc622550988e6862","https://github.com/zendframework/zend-session/commit/b1903947e285568344b3458e4524b016ce311072","https://github.com/zendframework/zend-session/commit/ff9236cc4c4944b5f5a6fbfee01420ef82c4fa91","https://framework.zend.com/security/advisory/ZF2015-01","https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-session/ZF2015-01.yaml","https://github.com/zendframework/zend-session"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-96c6-m98x-hxjx","url":"https://osv.dev/vulnerability/GHSA-96c6-m98x-hxjx"}],"summary":"Zend-Session session validation vulnerability"}