CVE-2022-24895

HIGH Year: 2022
CVSS v3 Score
8.8
High
Weakness Type
CWE-384
View all →

Vulnerability Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.

Related Vulnerabilities

CVE-2015-5384

HIGH
CVSS:8.8(High)

AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack.

CWE-3842015

CVE-2017-1000150

HIGH
CVSS:8.8(High)

Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation a...

CWE-3842017

CVE-2017-11191

HIGH
CVSS:8.8(High)

FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that had ...

CWE-3842017

CVE-2017-11562

HIGH
CVSS:8.8(High)

A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via login_if.php.

CWE-3842017

CVE-2017-14163

HIGH
CVSS:8.8(High)

An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. When one closes the browser without logging out of Mahara, the value in the usr...

CWE-3842017