CVE-2024-51996
HIGHSymfony <5.4.46, <6.4.14, <7.1.7 - Auth Bypass
Title source: llmDescription
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
Exploits (1)
Scores
CVSS v3
7.5
EPSS
0.0009
EPSS Percentile
25.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-287
CWE-289
Status
published
Products (4)
symfony/security-http
5.3.0 - 5.4.47Packagist
symfony/symfony
>= 5.3.0, < 5.4.47
symfony/symfony
>= 6.0.0-BETA1, < 6.4.15
symfony/symfony
>= 7.0.0-BETA1, < 7.1.8
Published
Nov 13, 2024
Tracked Since
Feb 18, 2026