GHSA-8wx3-8m4x-g5h4
GHSA-8wx3-8m4x-g5h4 · FOSUserBundle User Identity Validation Vulnerability
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their username. The fix in version 1.2.1 addresses this issue by loading the user using the primary key during refreshing.
Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
friendsofsymfony/user-bundle Packagist
- Versiones
- 1.1.0
- 1.2.0
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 1.0.0, < 1.2.1
Actualiza a 1.2.1
Fuentes originales
- https://github.com/FriendsOfSymfony/FOSUserBundle/commit/1b8bc18e3d99ef0b52b4141f20da323033d6be9b
- https://github.com/FriendsOfSymfony/FOSUserBundle/commit/5a36e2958068d1e6501dc8cf39bbae3ebb859d9f
- https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/user-bundle/2012-07-10-1.yaml
- https://github.com/FriendsOfSymfony/FOSUserBundle
- https://github.com/FriendsOfSymfony/FOSUserBundle/blob/master/Changelog.md
- https://osv.dev/vulnerability/GHSA-8wx3-8m4x-g5h4