CVE-2024-51996
Symphony has an Authentication Bypass via RememberMe
Summary
Symphony has an Authentication Bypass via RememberMe
Original description
The description as published by the source.
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-51996 symfony Fixed in: 5.4.23+dfsg-1+deb12u4
- Ubuntu UBUNTU-CVE-2024-51996 symfony
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com