Cross-site Request Forgery (CSRF) Affecting symfony/security-bundle package, versions >=2.0.0, <4.4.50 >=5.0.0, <5.4.20 >=6.0.0, <6.0.20 >=6.1.0, <6.1.12 >=6.2.0, <6.2.6
Threat Intelligence
EPSS
0.2% (59th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SYMFONYSECURITYBUNDLE-3262973
- published 1 Feb 2023
- disclosed 1 Feb 2023
- credit Marco Squarcina
Introduced: 1 Feb 2023
CVE-2022-24895 Open this link in a new tabHow to fix?
Upgrade symfony/security-bundle to version 4.4.50, 5.4.20, 6.0.20, 6.1.12, 6.2.6 or higher.
Overview
symfony/security-bundle is a security bundle for Symfony.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) such that the library regenerates the session ID upon user login while preserving all other session attributes by default. The implemented logic does not clear CSRF tokens. As a result, same-site attackers may be able to bypass the CSRF protection mechanism by executing a session-fixation attack.
References
CVSS Scores
version 3.1