Improper authentication in Symfony
High severity
GitHub Reviewed
Published
Feb 12, 2020
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
>= 2.7.0, < 2.7.51
>= 2.8.0, < 2.8.50
>= 3.0.0, < 3.4.26
>= 4.0.0, < 4.1.12
>= 4.2.0, < 4.2.7
Patched versions
2.7.51
2.8.50
3.4.26
4.1.12
4.2.7
>= 2.7.0, < 2.7.51
>= 2.8.0, < 2.8.50
>= 3.0.0, < 3.4.26
>= 4.0.0, < 4.1.12
>= 4.2.0, < 4.2.7
2.7.51
2.8.50
3.4.26
4.1.12
4.2.7
>= 2.7.0, < 2.7.51
>= 2.8.0, < 2.8.50
>= 3.0.0, < 3.4.26
>= 4.0.0, < 4.1.12
>= 4.2.0, < 4.2.7
2.7.51
2.8.50
3.4.26
4.1.12
4.2.7
Description
Published by the National Vulnerability Database
May 16, 2019
Reviewed
Feb 11, 2020
Published to the GitHub Advisory Database
Feb 12, 2020
Last updated
Feb 1, 2023
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
References