CVE-2024-51996
Symphony has an Authentication Bypass via RememberMe
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.62 % · percentile 50 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Deferred
Description
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-cg23-qf8f-62rr — Symfony has an Authentication Bypass via RememberMe
European references
- ENISA EUVD · EUVD-2024-3234
- GCVE · GCVE-0-2024-51996
CERT-FR advisories
- CERTFR-2024-AVI-0984 — Vulnérabilité dans les produits Symfony · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| symfony · symfony | affected >= 5.3.0, < 5.4.47 ; affected >= 6.0.0-BETA1, < 6.4.15 ; affected >= 7.0.0-BETA1, < 7.1.8 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |