{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-11-23T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Session fixation vulnerability in the \"Remember Me\" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-09T18:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "FEDORA-2015-0efcb5fbc5", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html"}, {"name": "20151222 [RT-SA-2015-013] Symfony PHP Framework: Session Fixation In \"Remember Me\" Login Functionality", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/537183/100/0/threaded"}, {"name": "FEDORA-2015-0b89738311", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html"}, {"name": "DSA-3402", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3402"}, {"name": "77694", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/77694"}, {"name": "20151222 [RT-SA-2015-013] Symfony PHP Framework: Session Fixation In \"Remember Me\" Login Functionality", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2015/Dec/89"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-8124", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Session fixation vulnerability in the \"Remember Me\" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "FEDORA-2015-0efcb5fbc5", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html"}, {"name": "20151222 [RT-SA-2015-013] Symfony PHP Framework: Session Fixation In \"Remember Me\" Login Functionality", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/537183/100/0/threaded"}, {"name": "FEDORA-2015-0b89738311", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html"}, {"name": "DSA-3402", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3402"}, {"name": "77694", "refsource": "BID", "url": "http://www.securityfocus.com/bid/77694"}, {"name": "20151222 [RT-SA-2015-013] Symfony PHP Framework: Session Fixation In \"Remember Me\" Login Functionality", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2015/Dec/89"}, {"name": "https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature", "refsource": "CONFIRM", "url": "https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T08:13:31.834Z"}, "title": "CVE Program Container", "references": [{"name": "FEDORA-2015-0efcb5fbc5", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html"}, {"name": "20151222 [RT-SA-2015-013] Symfony PHP Framework: Session Fixation In \"Remember Me\" Login Functionality", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/537183/100/0/threaded"}, {"name": "FEDORA-2015-0b89738311", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html"}, {"name": "DSA-3402", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3402"}, {"name": "77694", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/77694"}, {"name": "20151222 [RT-SA-2015-013] Symfony PHP Framework: Session Fixation In \"Remember Me\" Login Functionality", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2015/Dec/89"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-8124", "datePublished": "2015-12-07T20:00:00.000Z", "dateReserved": "2015-11-12T00:00:00.000Z", "dateUpdated": "2024-08-06T08:13:31.834Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "815710CF-CD6F-482A-AA49-F5DBD69CC78C", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "3614217B-B696-42F5-B700-154DC4A10362", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "C9F16129-1132-410A-ABF5-07043E748EBE", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "86E24535-7FDC-4CD5-9CFF-BE3497D8142A", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "39FAF963-1682-42ED-BE1C-04F4D67BC7E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "A6FAD933-5F1B-443C-833A-A7CA42B3E3AA", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "8315CC2E-1CA5-4877-9D8B-B1CE4C7E951A", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "B65CCFF0-491A-49AC-89DC-1C5BB2E17C62", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "FBF037E9-7BCB-4B15-90E5-AC12B635FCFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.9:*:*:*:*:*:*:*", "matchCriteriaId": "EB53AD64-7FA3-4B51-9BA4-1E6CEBC320B3", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.10:*:*:*:*:*:*:*", "matchCriteriaId": "E4299D5E-496C-455A-B6CB-1324D73E3BD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.11:*:*:*:*:*:*:*", "matchCriteriaId": "D52D4F61-92C2-44BA-8913-84C7B9625ECA", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.12:*:*:*:*:*:*:*", "matchCriteriaId": "AE64BBD6-A363-4331-B146-A15C299FA9B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.13:*:*:*:*:*:*:*", "matchCriteriaId": "D3193871-9D22-489C-999C-047D126CB2A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.14:*:*:*:*:*:*:*", "matchCriteriaId": "24349F39-72FD-4669-99EB-C53EA8D30703", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.15:*:*:*:*:*:*:*", "matchCriteriaId": "7B4D9AFF-7F87-48CC-9C82-FC89F909A82C", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.16:*:*:*:*:*:*:*", "matchCriteriaId": "2E4C305C-1FDF-4D93-97F5-10D8C8ABE7B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.17:*:*:*:*:*:*:*", "matchCriteriaId": "A1770E39-DCE8-4F81-9E18-F606CEA1DA6F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.18:*:*:*:*:*:*:*", "matchCriteriaId": "104DB666-5608-4822-B4DA-A8BFB64856E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.19:*:*:*:*:*:*:*", "matchCriteriaId": "5B629031-7AC2-4918-9FEC-C9D26EBB0161", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.20:*:*:*:*:*:*:*", "matchCriteriaId": "397E0404-9856-45C1-B12D-058E84F3FA3C", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.21:*:*:*:*:*:*:*", "matchCriteriaId": "A2EC987B-3C4D-4575-9BC8-9AFB794A20E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.22:*:*:*:*:*:*:*", "matchCriteriaId": "DE17FB48-06AA-4275-9F3A-0CF008C9C86B", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.23:*:*:*:*:*:*:*", "matchCriteriaId": "39F81F64-CCF2-4CB1-9504-153267839BEE", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.24:*:*:*:*:*:*:*", "matchCriteriaId": "7B1244EA-78F7-4501-9E42-52C77CE37963", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.25:*:*:*:*:*:*:*", "matchCriteriaId": "CBCD0661-41FA-4F89-A1D8-C50BE232D36D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.26:*:*:*:*:*:*:*", "matchCriteriaId": "1AC87263-68E3-4BF8-8ED7-C40CC2F8CE2A", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.27:*:*:*:*:*:*:*", "matchCriteriaId": "51A66842-7423-49F0-9FD3-64B7DE146F30", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.28:*:*:*:*:*:*:*", "matchCriteriaId": "68CBB5C6-C707-43E9-AFC5-467E376D9218", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.29:*:*:*:*:*:*:*", "matchCriteriaId": "53ADBD77-5D7C-4065-AF07-0D7D913EAB4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.30:*:*:*:*:*:*:*", "matchCriteriaId": "60E9C327-F168-4591-AF45-86AC9695AFBD", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.31:*:*:*:*:*:*:*", "matchCriteriaId": "44A428C5-7A39-4B17-850C-5A2BA7D207B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.32:*:*:*:*:*:*:*", "matchCriteriaId": "D6EAA53F-6A62-4BD5-BB3D-B95885877067", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.33:*:*:*:*:*:*:*", "matchCriteriaId": "5C839442-0832-42C7-8D3C-C3BC75F96CC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.34:*:*:*:*:*:*:*", "matchCriteriaId": "07CA4138-9897-44A5-BBCC-B5054D5F9EDF", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "0F13A190-1F97-4D7B-826A-E976934AE82B", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "27770F28-584A-48E1-B885-6C6D17F546ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "3D52659E-1F0D-4319-A986-9BA512995C62", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "C177DF32-F356-483C-82E5-8FCC68D89A74", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.4:*:*:*:*:*:*:*", "matchCriteriaId": "C6D9461C-A049-48EC-BB3E-FD3212C82795", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.5:*:*:*:*:*:*:*", "matchCriteriaId": "0F7EF330-714D-42E4-A2CF-406B84F3945B", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.6:*:*:*:*:*:*:*", "matchCriteriaId": "2D86A4FF-9BD2-4B3D-A2CE-E9200A4EC690", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.7:*:*:*:*:*:*:*", "matchCriteriaId": "5D6667BA-5A82-480B-AD9B-0E4CD0188458", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.8:*:*:*:*:*:*:*", "matchCriteriaId": "7CFF0C34-4474-448B-8402-F9F7E6E1BA00", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.9:*:*:*:*:*:*:*", "matchCriteriaId": "3EA6C319-AE4B-419F-BCAD-57D8ACF83EA2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.10:*:*:*:*:*:*:*", "matchCriteriaId": "00E132C9-F809-4AD9-959B-FFA8CB92780D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.11:*:*:*:*:*:*:*", "matchCriteriaId": "83BE3955-422A-4E81-9B81-4C2484E5C335", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "ABCF4EF8-5251-46B4-9B53-44783CD82082", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "A03AAA02-DB58-42C5-B4A6-C2608CDB7123", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "B7DA4FA9-AED8-4CCB-85E4-6D0BF6776FC2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.3:*:*:*:*:*:*:*", "matchCriteriaId": "32021069-B447-40B2-BBF9-0D2CFDE8ECC5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.4:*:*:*:*:*:*:*", "matchCriteriaId": "38F01C2E-5A1B-441A-B58C-C450AA1C1410", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.5:*:*:*:*:*:*:*", "matchCriteriaId": "660AA98C-4E93-4D8B-A4EC-A94E24DCDB9E", "vulnerable": true}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.6:*:*:*:*:*:*:*", "matchCriteriaId": "388F9E94-C2C1-4010-97DA-B008E89D500F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Session fixation vulnerability in the \"Remember Me\" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id."}, {"lang": "es", "value": "Vulnerabilidad de fijaci\u00f3n de sesi\u00f3n en la funcionalidad de inicio de sesi\u00f3n 'Remember Me' en Symfony 2.3.x en versiones anteriores a 2.3.35, 2.6.x en versiones anteriores a 2.6.12 y 2.7.x en versiones anteriores a 2.7.7 permite a atacantes remotos secuestrar sesiones web a trav\u00e9s de un id de sesi\u00f3n."}], "evaluatorComment": "<a href=\"https://cwe.mitre.org/data/definitions/384.htm\">CWE-384: Session Fixation</a>", "id": "CVE-2015-8124", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-12-07T20:59:14.110", "references": [{"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html"}, {"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html"}, {"source": "cve@mitre.org", "url": "http://seclists.org/fulldisclosure/2015/Dec/89"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2015/dsa-3402"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/537183/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/77694"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2015/Dec/89"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3402"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/537183/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/77694"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}