CVE-2022-24895

Katalog CVE

CVSS 8.8 · High EPSS 0,79%

Kerentanan Session Fixation pada sensiolabs symfony. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.

Rincian

Terbit di NVD

3 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-384: Session Fixation
CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/security-bundle/commit/076fd2088ada33d760758d98ff07ddedbf567946 patch
• https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4 patch
• https://github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67m patch · advisory pihak ketiga
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2022-24895.yaml issue tracking
• https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html