CVE-2022-23601

published 2022-02-01

CVE-2022-23601: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection…

Priority P3 43 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled. In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks. This issue has been resolved in the patch versions listed and users are advised to update. There are no known workarounds for this issue.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	symfony	—	—
sensiolabs	symfony	< 5.3.15	5.3.15
sensiolabs	symfony	>= 5.4.0 < 5.4.4	5.4.4
sensiolabs	symfony	>= 6.0.0 < 6.0.4	6.0.4
symfony	framework-bundle	>= 5.3.14 < 5.3.15	5.3.15
symfony	framework-bundle	>= 5.4.3 < 5.4.4	5.4.4
symfony	framework-bundle	>= 6.0.3 < 6.0.4	6.0.4
symfony	symfony	—	—
symfony	symfony	—	—
symfony	symfony	—	—

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

vendor_debian 8.1 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352