p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de symfony/security-bundle

Vulnerabilidades publicadas para symfony/security-bundle en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 5

  1. CVE-2024-50341

    Baja · CVSS 3.1EPSS 0,31%Corrección disponible

    Security::login does not take into account custom user_checker in symfony/security-bundle

    symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/security-bundle symfony/security-bundle symfony/security-bundlePHP
    • Actualiza a 6.4.10
    • Actualiza a 7.0.10
    • Actualiza a 7.1.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2022-24895

    Media · CVSS 6.3EPSS 0,79%Corrección disponible

    Symfony vulnerable to Session Fixation of CSRF tokens

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.

    symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundlePHP
    • Actualiza a 4.4.50
    • Actualiza a 5.4.20
    • Actualiza a 6.0.20
    • Actualiza a 6.1.12
    • Actualiza a 6.2.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2021-41268

    Media · CVSS 6.5EPSS 1,32%Corrección disponible

    Cookie persistence in Symfony

    Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie. Starting with version 5.3.12, Symfony makes the password part of the signature by default. In that way, when the password changes, then the cookie is not valid anymore.

    symfony/security-bundlePHP
    • Actualiza a 5.3.12
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2018-11408

    Media · CVSS 6.1EPSS 1,12%Corrección disponible

    CVE-2018-11408

    The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.

    symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundlePHP
    • Actualiza a 2.7.48
    • Actualiza a 2.8.41
    • Actualiza a 3.3.17
    • Actualiza a 3.4.11
    • Actualiza a 4.0.11
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2018-11406

    Alta · CVSS 8.8EPSS 0,75%Corrección disponible

    CVE-2018-11406

    An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.

    symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundlePHP
    • Actualiza a 2.7.48
    • Actualiza a 2.8.41
    • Actualiza a 3.3.17
    • Actualiza a 3.4.11
    • Actualiza a 4.0.11
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →