CVE-2024-36611
published 2024-11-29CVE-2024-36611: In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.76%
51.5th percentile
In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | symfony | — | — |
| symfony | security-http | >= 0 < 7.1.0 | 7.1.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2024-36611: symfony - In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthen...
vendor_debian·2024·CVSS 7.5
CVE-2024-36611 [HIGH] CVE-2024-36611: symfony - In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthen...
In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
Withdrawn Advisory: Symfony http-security has authentication bypass
ghsa·2024-11-29
CVE-2024-36611 [MEDIUM] CWE-287 Withdrawn Advisory: Symfony http-security has authentication bypass
Withdrawn Advisory: Symfony http-security has authentication bypass
## Withdrawn Advisory
This advisory has been withdrawn because the report is not part of a valid vulnerability. This link is maintained to preserve external references. For more information, see advisory-database/pull/5046.
## Original Description
In Symfony, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service.
OSV
CVE-2024-36611: In Symfony v7
osv·2024-11-29·CVSS 7.5
CVE-2024-36611 [HIGH] CVE-2024-36611: In Symfony v7
In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gist.github.com/1047524396/3581425e0911b716cf8ce4fa30e41e6chttps://github.com/github/advisory-database/pull/5046https://github.com/symfony/symfony/blob/v7.0.7/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php#L132https://github.com/symfony/symfony/commit/a804ca15fcad279d7727b91d12a667fd5b925995https://github.com/symfony/symfony/issues/59077#issuecomment-2513935018
2024-11-29
Published