Authentication Bypass Affecting symfony/symfony package, versions >=2.0.0, <4.4.50 >=5.0.0, <5.4.20 >=6.0.0, <6.0.20 >=6.1.0, <6.1.12 >=6.2.0, <6.2.6
Threat Intelligence
EPSS
0.22% (61st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SYMFONYSYMFONY-3266807
- published 2 Feb 2023
- disclosed 1 Feb 2023
- credit Soner Sayakci
Introduced: 1 Feb 2023
CVE-2022-24894 Open this link in a new tabHow to fix?
Upgrade symfony/symfony to version 4.4.50, 5.4.20, 6.0.20, 6.1.12, 6.2.6 or higher.
Overview
symfony/symfony is a PHP framework for web applications and a set of reusable PHP components.
Affected versions of this package are vulnerable to Authentication Bypass such that if the Symfony HTTP cache system is enabled, this header might be stored and returned to some other clients. An attacker can use this vulnerability to retrieve the victim's session.
References
CVSS Scores
version 3.1