CVE-2024-51996
CVE-2024-51996 · Symphony has an Authentication Bypass via RememberMe
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
CVSS 7.5 · High · EPSS 0.6% · Fix available
- Published
- Updated
Affected products and versions
symfony
- Versions
- >= 5.3.0, < 5.4.47: Affected
- >= 6.0.0-BETA1, < 6.4.15: Affected
- >= 7.0.0-BETA1, < 7.1.8: Affected
No fix published
symfony Debian:12
- Versions
- 5.4.23+dfsg-1
- 5.4.23+dfsg-1+deb12u1
- 5.4.23+dfsg-1+deb12u2
- 5.4.23+dfsg-1+deb12u3
- Affected ranges
- ECOSYSTEM: < 5.4.23+dfsg-1+deb12u4
Update to 5.4.23+dfsg-1+deb12u4
symfony Debian:13
- Affected ranges
- ECOSYSTEM: < 6.4.15+dfsg-1
Update to 6.4.15+dfsg-1
symfony Debian:14
- Affected ranges
- ECOSYSTEM: < 6.4.15+dfsg-1
Update to 6.4.15+dfsg-1
symfony/security-http Packagist
- Versions
- v5.3.0
- v5.3.1
- v5.3.10
- v5.3.11
- v5.3.13
- v5.3.14
- v5.3.2
- v5.3.3
- v5.3.4
- v5.3.6
- v5.3.7
- v5.3.8
- v5.4.0
- v5.4.0-BETA1
- v5.4.0-BETA2
- v5.4.0-RC1
- v5.4.10
- v5.4.11
- v5.4.12
- v5.4.13
- v5.4.15
- v5.4.17
- v5.4.19
- v5.4.2
- v5.4.20
- v5.4.21
- v5.4.22
- v5.4.23
- v5.4.26
- v5.4.28
- v5.4.3
- v5.4.30
- v5.4.31
- v5.4.35
- v5.4.36
- v5.4.38
- v5.4.39
- v5.4.40
- v5.4.41
- v5.4.43
- v5.4.44
- v5.4.45
- v5.4.46
- v5.4.5
- v5.4.8
- v5.4.9
- Affected ranges
- ECOSYSTEM: ≥ 5.3.0, < 5.4.47
Update to 5.4.47
symfony/security-http Packagist
- Versions
- v6.0.0
- v6.0.0-BETA1
- v6.0.0-BETA2
- v6.0.0-RC1
- v6.0.1
- v6.0.10
- v6.0.11
- v6.0.12
- v6.0.13
- v6.0.14
- v6.0.15
- v6.0.17
- v6.0.19
- v6.0.2
- v6.0.20
- v6.0.3
- v6.0.5
- v6.0.7
- v6.0.8
- v6.0.9
- v6.1.0
- v6.1.0-BETA1
- v6.1.0-BETA2
- v6.1.0-RC1
- v6.1.1
- v6.1.11
- v6.1.12
- v6.1.2
- v6.1.3
- v6.1.4
- v6.1.5
- v6.1.6
- v6.1.7
- v6.1.9
- v6.2.0
- v6.2.0-BETA1
- v6.2.0-BETA3
- v6.2.0-RC1
- v6.2.10
- v6.2.11
- v6.2.13
- v6.2.2
- v6.2.5
- v6.2.6
- v6.2.7
- v6.2.8
- v6.3.0
- v6.3.0-BETA1
- v6.3.0-RC1
- v6.3.1
- v6.3.12
- v6.3.2
- v6.3.4
- v6.3.5
- v6.3.6
- v6.3.8
- v6.4.0
- v6.4.0-BETA1
- v6.4.0-BETA3
- v6.4.0-RC1
- v6.4.0-RC2
- v6.4.11
- v6.4.12
- v6.4.13
- v6.4.14
- v6.4.3
- v6.4.4
- v6.4.7
- v6.4.8
- v6.4.9
- Affected ranges
- ECOSYSTEM: ≥ 6.0.0-BETA1, < 6.4.15
Update to 6.4.15
symfony/security-http Packagist
- Versions
- v7.0.0
- v7.0.0-BETA1
- v7.0.0-BETA3
- v7.0.0-RC1
- v7.0.0-RC2
- v7.0.1
- v7.0.3
- v7.0.4
- v7.0.7
- v7.0.8
- v7.0.9
- v7.1.0
- v7.1.0-BETA1
- v7.1.0-RC1
- v7.1.1
- v7.1.2
- v7.1.3
- v7.1.4
- v7.1.5
- v7.1.6
- v7.1.7
- Affected ranges
- ECOSYSTEM: ≥ 7.0.0-BETA1, < 7.1.8
Update to 7.1.8
symfony Ubuntu:22.04:LTS
- Versions
- 5.2.6+dfsg-1ubuntu7
- 5.4.4+dfsg-1ubuntu8
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:Pro:24.04:LTS
- Versions
- 5.4.23+dfsg-1ubuntu1
- 5.4.35+dfsg-3ubuntu1
- 6.4.5+dfsg-3ubuntu2
- 6.4.5+dfsg-3ubuntu3
- Affected ranges
- ECOSYSTEM: < 6.4.5+dfsg-3ubuntu3+esm1
Update to 6.4.5+dfsg-3ubuntu3+esm1
symfony Ubuntu:25.10
- Versions
- 6.4.18+dfsg-1ubuntu1
- 6.4.21+dfsg-2
- 6.4.21+dfsg-2ubuntu1
- 6.4.24+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:26.04:LTS
- Versions
- 6.4.24+dfsg-1
- 7.4.5+dfsg-1ubuntu1
- 7.4.6+dfsg-2ubuntu1
- 7.4.7+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published