CVE-2019-10911: Improper authentication in Symfony
Summary
CVE-2019-10911: Improper authentication in Symfony. Affects symfony/security-http across 5 version ranges.
>= 2.7.0, < 2.7.51
>= 2.8.0, < 2.8.50
>= 3.0.0, < 3.4.26
>= 4.0.0, < 4.1.12
>= 4.2.0, < 4.2.7
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- symfony · Debian:11
The same CVE-2019-10911 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a popular PHP framework used for developing web applications. The 'symfony/security-http' component provides security features for Symfony applications, including user authentication. This vulnerability affects versions 2.7.0 to 2.7.51, 2.8.0 to 2.8.50, 3.0.0 to 3.4.26, 4.0.0 to 4.1.12, and 4.2.0 to 4.2.7 of the 'symfony/security-http' package. It allows an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled.
Vulnerability Detail
The vulnerability arises due to improper authentication implementation in Symfony. By exploiting this issue, an attacker can gain unauthorized access as a privileged user on affected websites. This can lead to various security risks, such as unauthorized access to sensitive information, privilege escalation, and potential data breaches. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.512.7.51composer require symfony/security-http:2.7.51 -
>= 2.8.0, < 2.8.502.8.50composer require symfony/security-http:2.8.50 -
>= 3.0.0, < 3.4.263.4.26composer require symfony/security-http:3.4.26 -
>= 4.0.0, < 4.1.124.1.12composer require symfony/security-http:4.1.12 -
>= 4.2.0, < 4.2.74.2.7composer require symfony/security-http:4.2.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading the affected package to the latest patched version.
Conclusion
In conclusion, the 'symfony/security-http' package in Symfony versions 2.7.0 to 2.7.51, 2.8.0 to 2.8.50, 3.0.0 to 3.4.26, 4.0.0 to 4.1.12, and 4.2.0 to 4.2.7 is vulnerable to improper authentication. It is crucial to upgrade to the latest patched version to mitigate the risk of unauthorized access and potential security breaches. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/security-http →
FAQ
The vulnerability allows an attacker to authenticate as a privileged user on affected websites, potentially leading to unauthorized access, privilege escalation, and data breaches.
Versions 2.7.0 to 2.7.51, 2.8.0 to 2.8.50, 3.0.0 to 3.4.26, 4.0.0 to 4.1.12, and 4.2.0 to 4.2.7 of the 'symfony/security-http' package are affected.
No, there are no known workarounds. It is recommended to upgrade the affected package to the latest patched version.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's vulnerability monitoring service to check if your application is affected by this vulnerability. Visit Vulert Scanner and provide your composer.lock file for analysis.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/security-http.
