You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
CVE-2018-11406 - High Severity Vulnerability
Vulnerable Library - symfonyv2.6.6
The Symfony PHP framework
Library home page: https://github.com/symfony/symfony.git
Found in base branch: master
Vulnerable Source Files (2)
/vendor/symfony/security-csrf/Symfony/Component/Security/Csrf/TokenStorage/SessionTokenStorage.php
/vendor/symfony/security-csrf/Symfony/Component/Security/Csrf/TokenStorage/NativeSessionTokenStorage.php
Vulnerability Details
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
Publish Date: 2018-06-13
URL: CVE-2018-11406
CVSS 3 Score Details (8.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-11406
Release Date: 2018-06-13
Fix Resolution: 2.7.48,2.8.41,3.3.17,3.4.11,4.0.11
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: