CVE-2024-51996
published 2024-11-13CVE-2024-51996: Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.63%
46.3th percentile
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | symfony | < symfony 5.4.23+dfsg-1+deb12u4 (bookworm) | symfony 5.4.23+dfsg-1+deb12u4 (bookworm) |
| symfony | security-http | >= 5.3.0 < 5.4.47 | 5.4.47 |
| symfony | security-http | >= 6.0.0-BETA1 < 6.4.15 | 6.4.15 |
| symfony | security-http | >= 7.0.0-BETA1 < 7.1.8 | 7.1.8 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 0 < 5.4.23+dfsg-1+deb12u4 | 5.4.23+dfsg-1+deb12u4 |
| symfony | symfony | >= 0 < 6.4.15+dfsg-1 | 6.4.15+dfsg-1 |
| symfony | symfony | >= 0 < 6.4.15+dfsg-1 | 6.4.15+dfsg-1 |
| symfony | symfony | >= 0 < 4.3.8+dfsg-1ubuntu1+esm2 | 4.3.8+dfsg-1ubuntu1+esm2 |
| symfony | symfony | >= 0 < 5.4.4+dfsg-1ubuntu8+esm1 | 5.4.4+dfsg-1ubuntu8+esm1 |
| symfony | symfony | >= 0 < 6.4.5+dfsg-3ubuntu3+esm1 | 6.4.5+dfsg-3ubuntu3+esm1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv8.8HIGH
vendor_debian7.5HIGH
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
symfony vulnerabilities
osv·2025-02-18·CVSS 8.8
CVE-2022-24894 [HIGH] symfony vulnerabilities
symfony vulnerabilities
Soner Sayakci discovered that Symfony incorrectly handled cookie storage in
the web cache. An attacker could possibly use this issue to obtain
sensitive information and access unauthorized resources. (CVE-2022-24894)
Marco Squarcina discovered that Symfony incorrectly handled the storage of
user session information. An attacker could possibly use this issue to
perform a cross-site request forgery (CSRF) attack. (CVE-2022-24895)
Pierre Rudloff discovered that Symfony incorrectly checked HTML input. An
attacker could possibly use this issue to perform cross site scripting.
(CVE-2023-46734)
Vladimir Dusheyko discovered that Symfony incorrectly sanitized special
input with a PHP directive in URL query strings. An attacker could possibly
use this issue to expose sens
OSV
CVE-2024-51996: Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes
osv·2024-11-13·CVSS 7.5
CVE-2024-51996 [HIGH] CVE-2024-51996: Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
GHSA
Symfony has an Authentication Bypass via RememberMe
ghsa·2024-11-13
CVE-2024-51996 [HIGH] CWE-287 Symfony has an Authentication Bypass via RememberMe
Symfony has an Authentication Bypass via RememberMe
### Description
When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass.
### Resolution
The `PersistentRememberMeHandler` class now ensures the submitted username is the cookie owner.
The patch for this issue is available [here](https://github.com/symfony/symfony/commit/81354d392c5f0b7a52bcbd729d6f82501e94135a) for branch 5.4.
### Credits
We would like to thank Moritz Rauch - Pentryx AG for reporting the issue and Jérémy Derussé for providing the fix.
OSV
Symfony has an Authentication Bypass via RememberMe
osv·2024-11-13
CVE-2024-51996 [HIGH] Symfony has an Authentication Bypass via RememberMe
Symfony has an Authentication Bypass via RememberMe
### Description
When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass.
### Resolution
The `PersistentRememberMeHandler` class now ensures the submitted username is the cookie owner.
The patch for this issue is available [here](https://github.com/symfony/symfony/commit/81354d392c5f0b7a52bcbd729d6f82501e94135a) for branch 5.4.
### Credits
We would like to thank Moritz Rauch - Pentryx AG for reporting the issue and Jérémy Derussé for providing the fix.
Ubuntu
Symfony vulnerabilities
vendor_ubuntu·2025-02-18·CVSS 5.9
CVE-2022-24895 [MEDIUM] Symfony vulnerabilities
Title: Symfony vulnerabilities
Summary: Several security issues were fixed in Symfony.
Soner Sayakci discovered that Symfony incorrectly handled cookie storage in
the web cache. An attacker could possibly use this issue to obtain
sensitive information and access unauthorized resources. (CVE-2022-24894)
Marco Squarcina discovered that Symfony incorrectly handled the storage of
user session information. An attacker could possibly use this issue to
perform a cross-site request forgery (CSRF) attack. (CVE-2022-24895)
Pierre Rudloff discovered that Symfony incorrectly checked HTML input. An
attacker could possibly use this issue to perform cross site scripting.
(CVE-2023-46734)
Vladimir Dusheyko discovered that Symfony incorrectly sanitized special
input with a PHP directive in URL query s
Debian
CVE-2024-51996: symfony - Symphony process is a module for the Symphony PHP framework which executes comma...
vendor_debian·2024·CVSS 7.5
CVE-2024-51996 [HIGH] CVE-2024-51996: symfony - Symphony process is a module for the Symphony PHP framework which executes comma...
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
Scope: local
bookworm: resolved (fixed in 5.4.23+dfsg-1+deb12u4)
bullseye: resolved
forky: resolved (fixed in 6.4.15+dfsg-1)
sid: resolved (fixed in 6.4.15+dfsg-1)
trixie: resolved (fixed in 6.4.15+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-13
Published