p PatchFirst

PatchFirst · Latest vulnerabilities

symfony/security-bundle vulnerabilities

Vulnerabilities published for symfony/security-bundle in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 5

  1. CVE-2024-50341

    Low · CVSS 3.1EPSS 0.31%Fix available

    Security::login does not take into account custom user_checker in symfony/security-bundle

    symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/security-bundle symfony/security-bundle symfony/security-bundlePHP
    • Update to 6.4.10
    • Update to 7.0.10
    • Update to 7.1.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2022-24895

    Medium · CVSS 6.3EPSS 0.79%Fix available

    Symfony vulnerable to Session Fixation of CSRF tokens

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.

    symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundlePHP
    • Update to 4.4.50
    • Update to 5.4.20
    • Update to 6.0.20
    • Update to 6.1.12
    • Update to 6.2.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2021-41268

    Medium · CVSS 6.5EPSS 1.32%Fix available

    Cookie persistence in Symfony

    Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie. Starting with version 5.3.12, Symfony makes the password part of the signature by default. In that way, when the password changes, then the cookie is not valid anymore.

    symfony/security-bundlePHP
    • Update to 5.3.12
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2018-11408

    Medium · CVSS 6.1EPSS 1.12%Fix available

    CVE-2018-11408

    The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.

    symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundlePHP
    • Update to 2.7.48
    • Update to 2.8.41
    • Update to 3.3.17
    • Update to 3.4.11
    • Update to 4.0.11
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2018-11406

    High · CVSS 8.8EPSS 0.75%Fix available

    CVE-2018-11406

    An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.

    symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundle symfony/security-bundlePHP
    • Update to 2.7.48
    • Update to 2.8.41
    • Update to 3.3.17
    • Update to 3.4.11
    • Update to 4.0.11
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →