Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Sensiolabs |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-3493-1 | symfony security update |
 EUVD |
EUVD-2023-0611 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch. |
 Github GHSA |
GHSA-3gv2-29qc-v67m | Symfony vulnerable to Session Fixation of CSRF tokens |
 Ubuntu USN |
USN-7272-1 | Symfony vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 10 Mar 2025 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 13 Feb 2025 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch. | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch. |
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-03-10T21:16:31.513Z
Reserved: 2022-02-10T16:41:34.956Z
Link: CVE-2022-24895
Vulnrichment
Updated: 2024-08-03T04:29:01.542Z
NVD
Status : Modified
Published: 2023-02-03T22:15:11.273
Modified: 2025-02-13T17:15:38.940
Link: CVE-2022-24895
Redhat
No data.
OpenCVE Enrichment
No data.