CVE-2002-0121: PHP

Low severity, CVSS 2.1. EPSS: 1.2% chance of exploitation in the next 30 days.

PHP 4.0 through 4.1.1 stores session IDs in temporary files whose name contains the session ID, which allows local users to hijack web connections.

Affected products

• PHP PHP: version 4.0.4 only; version 4.0.5 only; version 4.0.6 only; version 4.1.0 only; version 4.1.2 only

Published 2002-03-25. Last modified 2026-06-16.