CVE-2024-51996
Last modified
CVE-2024-51996 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. EPSS estimates a 0.63% chance of exploitation in the next 30 days.
Description
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-51996?
How severe is CVE-2024-51996?
How do I fix CVE-2024-51996?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-51990jj, or Jujutsu, is a Git-compatible VCS written in rust. In …9.3
- CVE-2024-51991October is a Content Management System (CMS) and web platfor…4.9
- CVE-2024-51992Orchid is a @laravel package that allows for rapid applicati…4.1
- CVE-2024-51993Combodo iTop is a web based IT Service Management tool. An a…3.4
- CVE-2024-51994Combodo iTop is a web based IT Service Management tool. In a…5.4
- CVE-2024-51995Combodo iTop is a web based IT Service Management tool. An a…7.1
- CVE-2024-51997Trustee is a set of tools and components for attesting confi…8.1
- CVE-2024-51998changedetection.io is a free open source web page change det…8.6
- CVE-2024-51999Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2024-5200The Postie WordPress plugin before 1.9.71 does not sanitise …4.8
- CVE-2024-52000Combodo iTop is a simple, web based IT Service Management to…6.1
- CVE-2024-52001Combodo iTop is a simple, web based IT Service Management to…4.3
Are you affected by CVE-2024-51996?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST