High severity · published Feb 1, 2022
CVE-2022-23601
Symfony is a PHP framework for web and console applications and a set of reusable PHP components
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled. In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks. This issue has been resolved in the patch versions listed and users are advised to update. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Symfony · Sensiolabs
before 5.3.15; 5.4.0 before 5.4.4; 6.0.0 before 6.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23601
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23601
Patch
https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50
Patch
https://github.com/symfony/symfony/security/advisories/GHSA-vvmr-8829-6whx
More from Symfony
9.8
CVE-2026-47767
Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
9.8
CVE-2024-51736
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes
9.8
CVE-2019-18889
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7
9.8
CVE-2019-11325
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8
9.8
CVE-2017-11365
Certain Symfony products are affected by: Incorrect Access Control