PT-2024-8444 · Symphony+4 · Symphony+4

M0Xr4 · Published 2024-11-04 · Updated 2025-02-18 · CVE-2024-51996

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Symphony versions prior to 5.4.47 Symphony versions prior to 6.4.15 Symphony versions prior to 7.1.8

Description The vulnerability is related to the authentication process in the Symphony PHP framework. When consuming a persisted remember-me cookie, the framework does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This issue can be exploited by a remote attacker to bypass security restrictions.

Recommendations For versions prior to 5.4.47, update to version 5.4.47 or later. For versions prior to 6.4.15, update to version 6.4.15 or later. For versions prior to 7.1.8, update to version 7.1.8 or later. As a temporary workaround, consider disabling the use of remember-me cookies until a patch is applied. Restrict access to the PersistentRememberMeHandler class to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-289

Related Identifiers

BDU:2024-10003

CVE-2024-51996

DSA-5813-1

GHSA-CG23-QF8F-62RR

USN-7272-1

Affected Products

Astra Linux

Debian

Linuxmint

Symphony

Ubuntu

References · 34

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51996.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-51996.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2024-51996.yaml · Exploit
• https://ubuntu.com/security/CVE-2024-50340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50343 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50345 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10003 · Security Note
• https://osv.dev/vulnerability/DSA-5813-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-51996 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46734 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-51996 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-51996 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-51996 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24894 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7272-1 · Vendor Advisory