PT-2015-7732 · Symfony · Symfony

Publicado 2015-11-24 · Atualizado 2022-05-14 · CVE-2015-8124

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symfony versions 2.3.x through 2.3.34 Symfony versions 2.6.x through 2.6.11 Symfony versions 2.7.x through 2.7.6

Description A session fixation issue in the "Remember Me" login feature allows remote attackers to hijack web sessions via a session id. This issue enables an attacker to impersonate the victim towards the web application if the session id value was previously known to the attacker.

Recommendations For Symfony versions 2.3.x through 2.3.34, update to version 2.3.35. For Symfony versions 2.6.x through 2.6.11, update to version 2.6.12. For Symfony versions 2.7.x through 2.7.6, update to version 2.7.7. As a temporary workaround, consider disabling the "Remember Me" feature until a patch is available.

Exploit

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2015-8124

DSA-3402-1

GHSA-J5JH-HPR4-H332

Produtos afetados

Symfony

Referências · 30

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8124.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8124.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8124.yaml · Exploit
• https://github.com/symfony/symfony/pull/16631 · Nota
• https://osv.dev/vulnerability/GHSA-j5jh-hpr4-h332 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8124 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8125 · Nota de Segurança
• http://securityfocus.com/archive/1/537183/100/0/threaded · Nota
• https://ubuntu.com/security/CVE-2015-8124 · Aviso do Fabricante
• http://securityfocus.com/bid/77694 · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-8124 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html · Aviso do Fabricante
• http://debian.org/security/2015/dsa-3402 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3402-1 · Aviso do Fabricante