CVE-2018-11385: Symfony Session Fixation Vulnerability
Summary
CVE-2018-11385: Symfony Session Fixation Vulnerability. Affects symfony/symfony across 5 version ranges.
>= 2.7.0, < 2.7.48
>= 2.8.0, < 2.8.41
>= 3.0.0, < 3.3.17
>= 3.4.0, < 3.4.11
>= 4.0.0, < 4.0.11
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- symfony · Debian:11
The same CVE-2018-11385 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Symfony package is a popular PHP framework used for developing web applications. It provides a set of reusable components and tools that simplify the development process. The Security component in Symfony is responsible for handling authentication and authorization. This vulnerability affects versions 2.7.x to 2.7.48, 2.8.x to 2.8.41, 3.3.x to 3.3.17, 3.4.x to 3.4.11, and 4.0.x to 4.0.11 of the Symfony package.
Vulnerability Detail
The vulnerability identified as CVE-2018-11385 is a session fixation vulnerability within the "Guard" login feature of the Symfony Security component. An attacker can exploit this vulnerability to impersonate a victim towards the web application if they have prior knowledge of the victim's session id value. This can lead to unauthorized access and potential misuse of the victim's account or sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.482.7.48composer require symfony/symfony:2.7.48 -
>= 2.8.0, < 2.8.412.8.41composer require symfony/symfony:2.8.41 -
>= 3.0.0, < 3.3.173.3.17composer require symfony/symfony:3.3.17 -
>= 3.4.0, < 3.4.113.4.11composer require symfony/symfony:3.4.11 -
>= 4.0.0, < 4.0.114.0.11composer require symfony/symfony:4.0.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading the Symfony package to the latest patched version.
Conclusion
In conclusion, the Symfony package is affected by a session fixation vulnerability in the "Guard" login feature. Upgrading to the latest patched version of the Symfony package is the recommended solution. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for symfony/symfony →
FAQ
This vulnerability allows an attacker to impersonate a victim towards the web application, potentially gaining unauthorized access to the victim's account or sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your composer.lock file to the playground and it will alert you in real-time.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix to mitigate the risk.
Yes, the CVSS score for this vulnerability is 8.1, indicating a high severity level.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g4rg-rw65-8hfg/GHSA-g4rg-rw65-8hfg.json
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/symfony.
