PT-2024-40166 · Doctrine+1 · Doctrine+1

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Symfony versions prior to 2.0.6

Description: The issue allows a user to switch to another user's account by changing their username via a form to an existing username, resulting in a validation error but modifying the user object in the session to the new username. This is possible when using Doctrine as a user provider and allowing users to update their login/username from a form. The problem arises because the user object in the session is updated based on the username, which can be changed. The fix involves refreshing the user via the primary key instead of the username.

Recommendations: For versions prior to 2.0.6, upgrade to Symfony 2.0.6 as soon as possible to address the security vulnerability. As a temporary workaround, consider applying the patch provided to prevent users from switching to other accounts by modifying the user object in the session based on the primary key instead of the username.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

GHSA-7MX2-7Q8P-PGMW

Affected Products

Doctrine

Symfony

References · 5

• https://osv.dev/vulnerability/GHSA-7mx2-7q8p-pgmw · Vendor Advisory
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/commit/9d2ab9ca9c1762 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/2011-11-16.yaml · Note
• https://symfony.com/blog/security-release-symfony-2-0-6 · Note