CVE-2024-51996
Last modified
CVE-2024-51996 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. EPSS estimates a 0.63% chance of exploitation in the next 30 days.
Description
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-51996?
How severe is CVE-2024-51996?
How do I fix CVE-2024-51996?
Are you affected by CVE-2024-51996?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST