CVE-2024-51996
Symphony has an Authentication Bypass via RememberMe
HIGH 7.5
En bref
- Source
- NVD
- EPSS
- EPSS 0.62 % · centile 50 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Deferred
Description
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
Faiblesses (CWE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
Avis
- GHSA-cg23-qf8f-62rr — Symfony has an Authentication Bypass via RememberMe
Références européennes
- ENISA EUVD · EUVD-2024-3234
- GCVE · GCVE-0-2024-51996
Avis du CERT-FR
- CERTFR-2024-AVI-0984 — Vulnérabilité dans les produits Symfony · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| symfony · symfony | affected >= 5.3.0, < 5.4.47 ; affected >= 6.0.0-BETA1, < 6.4.15 ; affected >= 7.0.0-BETA1, < 7.1.8 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |