CVE-2018-11385

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.

• CWE-384

• https://lists.debian.org/debian-lts-announce/2019/03/msg00009.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/
• https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authenticationVendor Advisory
• https://www.debian.org/security/2018/dsa-4262Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/03/msg00009.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/
• https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authenticationVendor Advisory
• https://www.debian.org/security/2018/dsa-4262Third Party Advisory

Published

Jun 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1138Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-11380The parse_import_ptr() function in radare2 2.5.0 allows remo…
• CVE-2018-11381The string_scan_range() function in radare2 2.5.0 allows rem…
• CVE-2018-11382The _inst__sts() function in radare2 2.5.0 allows remote att…
• CVE-2018-11383The r_strbuf_fini() function in radare2 2.5.0 allows remote …
• CVE-2018-11384The sh_op() function in radare2 2.5.0 allows remote attacker…
• CVE-2018-11386An issue was discovered in the HttpFoundation component in S…
• CVE-2018-1139A flaw was found in the way samba before 4.7.9 and 4.8.4 all…8.1
• CVE-2018-11392An arbitrary file upload vulnerability in /classes/profile.c…
• CVE-2018-11396ephy-session.c in libephymain.so in GNOME Web (aka Epiphany)…
• CVE-2018-11399SimpliSafe Original has Unencrypted Sensor Transmissions, wh…
• CVE-2018-1140A missing input sanitization flaw was found in the implement…6.5