CVE-2022-24895: Symfony is a PHP framework for web and console applications and a set of reusable PHP components | LiveThreat CVE Feed — Verisq

Login Request a demo

High severity · published Feb 3, 2023

CVE-2022-24895

Symfony is a PHP framework for web and console applications and a set of reusable PHP components

8.8

CVSS

0.8%

EPSS

No

On KEV

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 56% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

SY

Symfony · Sensiolabs

2.0.0 before 4.4.50; 5.0.0 before 5.4.20; 6.0.0 before 6.0.20; 6.1.0 before 6.1.12; 6.2.0 before 6.2.6 · source: NVD

Affected product

SY

Symfony

Sensiolabs

All Symfony CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2022-24895

https://www.cve.org/CVERecord?id=CVE-2022-24895

https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2022-24895.yaml

https://github.com/symfony/security-bundle/commit/076fd2088ada33d760758d98ff07ddedbf567946

https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4

https://github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67m

lists.debian.org

https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html

More from Symfony

9.8

Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

9.8

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes

9.8

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7

9.8

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8

9.8

Certain Symfony products are affected by: Incorrect Access Control