Unscored severity · published Dec 7, 2015
CVE-2015-8124
Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web…
–
CVSS
2.7%
EPSS
No
On KEV
Description
Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Symfony · Sensiolabs
2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-8124
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-8124
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html
seclists.org
http://seclists.org/fulldisclosure/2015/Dec/89
www.debian.org
http://www.debian.org/security/2015/dsa-3402
www.securityfocus.com
http://www.securityfocus.com/archive/1/537183/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/77694
More from Symfony
9.8
CVE-2026-47767
Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
9.8
CVE-2024-51736
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes
9.8
CVE-2019-18889
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7
9.8
CVE-2019-11325
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8
9.8
CVE-2017-11365
Certain Symfony products are affected by: Incorrect Access Control