Improper Authentication Affecting symfony/security-bundle package, versions >=5.3.0, <5.3.12
Threat Intelligence
EPSS
0.13% (50th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SYMFONYSECURITYBUNDLE-2434843
- published 24 Nov 2021
- disclosed 24 Nov 2021
- credit Thibaut Decherit, Wouter J
Introduced: 24 Nov 2021
CVE-2021-41268 Open this link in a new tabHow to fix?
Upgrade symfony/security-bundle to version 5.3.12 or higher.
Overview
symfony/security-bundle is a security bundle for Symfony.
Affected versions of this package are vulnerable to Improper Authentication since the remember me cookie is not invalidated anymore after the user changes its password.
Attackers can maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie.
References
CVSS Scores
version 3.1