PT-2024-9246 · Symfony+1 · Symfony+1

Markuspoerschke · Published 2024-02-07 · Updated 2024-12-03 · CVE-2024-36611

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Symfony version 7.07

Description: A security issue was identified in the FormLoginAuthenticator component of Symfony, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. However, the supplier has concluded that this report is false.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

BDU:2024-10934

CVE-2024-36611

GHSA-7Q22-X757-CMGC

Affected Products

Debian

Symfony

References · 21

• https://ubuntu.com/security/CVE-2024-36611 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36611 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-36611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36611 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-36611 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-36611 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7q22-x757-cmgc · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10934 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-36611 · Vendor Advisory
• https://github.com/symfony/symfony/issues/59077#issuecomment-2513935018 · Note
• https://github.com/symfony/symfony/commit/a804ca15fcad279d7727b91d12a667fd5b925995 · Note
• https://github.com/symfony/symfony/blob/v7.0.7/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php#L132 · Note
• https://github.com/symfony/symfony/pull/59079 · Note
• https://github.com/github/advisory-database/pull/5046 · Note
• https://github.com/symfony/security-http/blob/7.2/Authenticator/FormLoginAuthenticator.php · Note