CVE-2018-11406 – symfony/security

Package

Manager: composer
Name: symfony/security
Vulnerable Version: >=2.7.0 <2.7.48 || >=2.8.0 <2.8.41 || >=3.0.0 <3.3.17 || >=3.4.0 <3.4.11 || >=4.0.0 <4.0.11

Severity

Level: High

CVSS v3.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00194 pctl0.41552

Details

Symfony CSRF Token Fixation An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.

Metadata

Created: 2022-05-14T01:14:35Z
Modified: 2024-02-08T19:30:02Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g4g7-q726-v5hg/GHSA-g4g7-q726-v5hg.json
CWE IDs: ["CWE-352"]
Alternative ID: GHSA-g4g7-q726-v5hg
Finding: F076
Auto approve: 1