CVE-2024-51996CWE-287CWE-289

Symphony has an Authentication Bypass via RememberMe

High · published November 13, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00620 · 49.1th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-289 · Authentication Bypass by Alternate Name
Published
2024-11-13T16:18Z
EPSS history
Timeline
  • 13 NOV 16:18Z
    Symphony has an Authentication Bypass via RememberMe
    cvelistv5