Symfony vulnerable to Session Fixation of CSRF tokens
CVE-2022-24895
6.3MEDIUM
What is CVE-2022-24895?
The Symfony PHP framework, widely used for web and console applications, has a security issue where it fails to clear CSRF tokens during user session regeneration upon login. This oversight allows same-site attackers to potentially exploit the CSRF protection mechanism, thereby facilitating a session fixation attack. The vulnerability has been addressed in the 4.4 branch of Symfony to enhance security and protect users effectively. It is critical for developers using Symfony to update their applications to mitigate risks associated with this vulnerability.
Affected Version(s)
symfony >= 2.0.0, < 4.4.50 < 2.0.0, 4.4.50
symfony >= 5.0.0, < 5.4.20 < 5.0.0, 5.4.20
symfony >= 6.0.0, < 6.0.20 < 6.0.0, 6.0.20