Session Fixation Affecting symfony/symfony package, versions <2.7.48 >=2.8.0, <2.8.41 >=3.0.0, <3.3.17 >=3.4.0, <3.4.11 >=4.0.0, <4.0.11
Snyk CVSS
Attack Complexity
High
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
EPSS
0.51% (77th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SYMFONYSYMFONY-72200
- published 30 May 2018
- disclosed 30 May 2018
- credit Chris Wilkinson
Introduced: 30 May 2018
CVE-2018-11385 Open this link in a new tabHow to fix?
Upgrade symfony/symfony to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.
Overview
symfony/symfony is a set of reusable PHP components.
Affected versions of this package are vulnerable to Session Fixation via the Guard login feature. An attacker may be able to impersonate the victim towards the web application if the session id value was previously known to the attacker. This allows the attacker to access a Symfony web application with the attacked user's permissions.
Note:
- The
Guard authenticationlogin feature must be enabled for the attack to be applicable. - The attacker must have access to the
PHPSESSIDcookie value or has successfully set a new value in the user's browser.