CVE-2019-10911
published 2019-05-16CVE-2019-10911: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to…
PriorityP342high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
1.24%
66.0th percentile
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | symfony | < symfony 3.4.22+dfsg-2 (bookworm) | symfony 3.4.22+dfsg-2 (bookworm) |
| drupal | core | >= 8.0.0 < 8.5.15 | 8.5.15 |
| drupal | core | >= 8.6.0 < 8.6.15 | 8.6.15 |
| drupal | drupal | >= 8.5.0 < 8.5.15 | 8.5.15 |
| drupal | drupal | >= 8.6.0 < 8.6.15 | 8.6.15 |
| drupal | drupal_core | — | — |
| sensiolabs | symfony | >= 2.7.0 < 2.7.51 | 2.7.51 |
| sensiolabs | symfony | >= 2.8.0 < 2.8.50 | 2.8.50 |
| sensiolabs | symfony | >= 3.4.0 < 3.4.26 | 3.4.26 |
| sensiolabs | symfony | >= 4.1.0 < 4.1.12 | 4.1.12 |
| sensiolabs | symfony | >= 4.2.0 < 4.2.7 | 4.2.7 |
| symfony | security | >= 2.7.0 < 2.7.51 | 2.7.51 |
| symfony | security | >= 2.8.0 < 2.8.50 | 2.8.50 |
| symfony | security | >= 3.0.0 < 3.4.26 | 3.4.26 |
| symfony | security | >= 4.0.0 < 4.1.12 | 4.1.12 |
| symfony | security | >= 4.2.0 < 4.2.7 | 4.2.7 |
| symfony | security-http | >= 2.7.0 < 2.7.51 | 2.7.51 |
| symfony | security-http | >= 2.8.0 < 2.8.50 | 2.8.50 |
| symfony | security-http | >= 3.0.0 < 3.4.26 | 3.4.26 |
| symfony | security-http | >= 4.0.0 < 4.1.12 | 4.1.12 |
| symfony | security-http | >= 4.2.0 < 4.2.7 | 4.2.7 |
| symfony | symfony | >= 0 < 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
| symfony | symfony | >= 0 < 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
| symfony | symfony | >= 0 < 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
| symfony | symfony | >= 0 < 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper authentication in Symfony
ghsa·2020-02-12
CVE-2019-10911 [HIGH] CWE-200 Improper authentication in Symfony
Improper authentication in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
OSV
Improper authentication in Symfony
osv·2020-02-12
CVE-2019-10911 [HIGH] Improper authentication in Symfony
Improper authentication in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
OSV
CVE-2019-10911: In Symfony before 2
osv·2019-05-16·CVSS 7.5
CVE-2019-10911 [HIGH] CVE-2019-10911: In Symfony before 2
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
OSV
CVE-2019-10909: This security release fixes third-party dependencies included in or required by Drupal core
osv·2019-04-17·CVSS 5.4
CVE-2019-10909 [MEDIUM] CVE-2019-10909: This security release fixes third-party dependencies included in or required by Drupal core
This security release fixes third-party dependencies included in or required by Drupal core.
* [CVE-2019-10909: Escape validation messages in the PHP templating engine](https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine). From that advisory:
> Validation messages were not escaped when using the form theme of the PHP templating engine which, when validation messages may contain user input, could result in an XSS.
* [CVE-2019-10910: Check service IDs are valid](https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid). From that advisory:
> Service IDs derived from unfiltered user input could result in the execution of any arbitrary code, resulting in possible remote code execution.
* [CVE-2019-10911: Add a separator in the remember me
Drupal
Drupal core - Moderately critical - Multiple Vulnerabilities - SA-CORE-2019-005
vendor_drupal·2019-04-17·CVSS 5.4
CVE-2019-10909 [MEDIUM] Drupal core - Moderately critical - Multiple Vulnerabilities - SA-CORE-2019-005
Title: Drupal core - Moderately critical - Multiple Vulnerabilities - SA-CORE-2019-005
Vulnerability Type: Multiple Vulnerabilities
Description: This security release fixes third-party dependencies included in or required by Drupal core. CVE-2019-10909: Escape validation messages in the PHP templating engine . From that advisory: Validation messages were not escaped when using the form theme of the PHP templating engine which, when validation messages may contain user input, could result in an XSS. CVE-2019-10910: Check service IDs are valid . From that advisory: Service IDs derived from unfiltered user input could result in the execution of any arbitrary code, resulting in possible remote code execution. CVE-2019-10911: Add a separator in the remember me cookie hash . From that advisory
Debian
CVE-2019-10911: symfony - In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1...
vendor_debian·2019·CVSS 7.5
CVE-2019-10911 [HIGH] CVE-2019-10911: symfony - In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1...
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
Scope: local
bookworm: resolved (fixed in 3.4.22+dfsg-2)
bullseye: resolved (fixed in 3.4.22+dfsg-2)
forky: resolved (fixed in 3.4.22+dfsg-2)
sid: resolved (fixed in 3.4.22+dfsg-2)
trixie: resolved (fixed in 3.4.22+dfsg-2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-10911 php-symfony: drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user. [epel-
bugzilla·2019-05-17·CVSS 7.5
CVE-2019-10911 [HIGH] CVE-2019-10911 php-symfony: drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user. [epel-
CVE-2019-10911 php-symfony: drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user. [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the
Bugzilla
CVE-2019-10911 php-symfony: drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user. [fedor
bugzilla·2019-05-17·CVSS 7.5
CVE-2019-10911 [HIGH] CVE-2019-10911 php-symfony: drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user. [fedor
CVE-2019-10911 php-symfony: drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user. [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention
Bugzilla
CVE-2019-10911 drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user.
bugzilla·2019-04-30·CVSS 7.5
CVE-2019-10911 [HIGH] CVE-2019-10911 drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user.
CVE-2019-10911 drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user.
An attacker could modify the remember me cookie and authenticate as a different user. This attack is only possible if remember me functionality is enabled and the two users share a password hash or the password hashes are null.
External References:
https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash
Discussion:
Created drupal tracking bugs for this issue:
Affects: fedora-all [bug 1704657]
---
Created php-symfony tracking bugs for this issue:
Affects: epel-all [bug 1711316]
Affects: fedora-all [bug 1711315]
---
This CVE Bugzilla entry is for community support informati
Bugzilla
CVE-2019-10911 drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user. [fedora-all]
bugzilla·2019-04-30·CVSS 7.5
CVE-2019-10911 [HIGH] CVE-2019-10911 drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user. [fedora-all]
CVE-2019-10911 drupal: Part of an expiry time in a remember me cookie could be considered part of the username, where modifying it would lead to authentication as a different user. [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs b
https://github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hashhttps://www.synology.com/security/advisory/Synology_SA_19_19https://github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hashhttps://www.synology.com/security/advisory/Synology_SA_19_19
2019-05-16
Published