{"id":"CVE-2018-11406","published":"2018-06-13T16:00:00Z","modified":"2024-08-05T08:10:14Z","title":"An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before…","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00749,"percentile":0.54787,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://symfony.com/blog/cve-2018-11406-csrf-token-fixation","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.debian.org/security/2018/dsa-4262","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"priority":{"score":11.0,"factors":[{"name":"EPSS percentile","points":10.96}]},"affected":[{"ecosystem":"Packagist","package":"symfony/symfony","vulnerableRanges":[">=2.7.0, <2.7.48",">=2.8.0, <2.8.41",">=3.0.0, <3.3.17",">=3.4.0, <3.4.11",">=4.0.0, <4.0.11"],"patched":["2.7.48","2.8.41","3.3.17","3.4.11","4.0.11"],"from":["GHSA-g4g7-q726-v5hg"],"provenance":"source"},{"ecosystem":"Packagist","package":"symfony/security-bundle","vulnerableRanges":[">=2.7.0, <2.7.48",">=2.8.0, <2.8.41",">=3.0.0, <3.3.17",">=3.4.0, <3.4.11",">=4.0.0, <4.0.11"],"patched":["2.7.48","2.8.41","3.3.17","3.4.11","4.0.11"],"from":["GHSA-g4g7-q726-v5hg"],"provenance":"source"},{"ecosystem":"Packagist","package":"symfony/security-http","vulnerableRanges":[">=2.7.0, <2.7.48",">=2.8.0, <2.8.41",">=3.0.0, <3.3.17",">=3.4.0, <3.4.11",">=4.0.0, <4.0.11"],"patched":["2.7.48","2.8.41","3.3.17","3.4.11","4.0.11"],"from":["GHSA-g4g7-q726-v5hg"],"provenance":"source"},{"ecosystem":"Packagist","package":"symfony/security","vulnerableRanges":[">=2.7.0, <2.7.48",">=2.8.0, <2.8.41",">=3.0.0, <3.3.17",">=3.4.0, <3.4.11",">=4.0.0, <4.0.11"],"patched":["2.7.48","2.8.41","3.3.17","3.4.11","4.0.11"],"from":["GHSA-g4g7-q726-v5hg"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3882","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-symfony-symfony-cve-2017-16652","children":[{"from":"CVE-2018-11406","to":"CVE-2018-11408","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Symfony/Bundle/SecurityBundle/SecurityBundle.php"],"commits":["https://github.com/symfony/symfony/commit/319e1bdd43979d9c1559497de8d69adea28ab8d1","https://github.com/symfony/symfony/commit/b20e83562e32c56f8d9b8296ab07b0e4c0a54db8"],"basis":"shared function","functions":["build"]}]}],"packageHistory":[{"cve":"CVE-2016-4423","published":"2016-06-01","fixed":"3.0.6","kev":false},{"cve":"CVE-2017-16652","published":"2018-06-13","fixed":"3.3.13","kev":false,"link":{"from":"CVE-2017-16652","to":"CVE-2018-11406","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:symfony/security-http","fromFixed":"2.7.38","toFixed":"2.7.48","daysApart":0},{"kind":"version-step","provenance":"source","package":"Packagist:symfony/security-http","fromFixed":"3.3.13","toFixed":"3.3.17","daysApart":0}]}},{"cve":"CVE-2018-11385","published":"2018-06-13","fixed":"4.0.11","kev":false},{"cve":"CVE-2018-11406","published":"2018-06-13","fixed":"4.0.11","kev":false},{"cve":"CVE-2018-19790","published":"2018-12-18","fixed":"4.2.1","kev":false},{"cve":"CVE-2019-10911","published":"2019-05-16","fixed":"4.2.7","kev":false},{"cve":"CVE-2019-18886","published":"2019-11-21","fixed":"4.3.8","kev":false}],"package":"Packagist:symfony/security-http"}}