VulnerabilityDeferred

CVE-2024-51996

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes.

HIGH 7.5EPSS 0.62%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.62% probability · 48th percentile
CISA KEV: Not listed
Weakness: CWE-287, CWE-289
Source: security-advisories@github.com

References

https://github.com/symfony/symfony/commit/81354d392c5f0b7a52bcbd729d6f82501e94135a
https://github.com/symfony/symfony/security/advisories/GHSA-cg23-qf8f-62rr

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.