Improper Authentication Affecting symfony/security-http package, versions >=5.3.0, <5.3.2


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.19% (58th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Authentication vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PHP-SYMFONYSECURITYHTTP-1311804
  • published18 Jun 2021
  • disclosed18 Jun 2021
  • creditBogdan, gndk, Paweł Warchoł, Warxcell, Adrien Lamotte

Introduced: 18 Jun 2021

CVE-2021-32693  (opens in a new tab)
CWE-287  (opens in a new tab)

How to fix?

Upgrade symfony/security-http to version 5.3.2 or higher.

Overview

symfony/security-http is a provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials.

Affected versions of this package are vulnerable to Improper Authentication. When an application defines multiple firewalls, the authenticated token delivered by one of the firewalls is available to all other firewalls. This can be abused when the application defines different providers for different parts of an application. In such a situation, a user authenticated on one part of the application is considered authenticated on the whole application.

CVSS Scores

version 3.1