Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

symfony/security-bundle

5 known vulnerabilities (2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 2 medium, 1 low
Registry
Packagist

Advisories 5

  • Security::login does not take into account custom user_checker in symfony/security-bundle

    Affected: from 6.2.0, fixed in 6.4.10; from 7.0.0, fixed in 7.0.10; from 7.1.0, fixed in 7.1.3.

  • CVE-2022-24895Medium 6.3

    Symfony vulnerable to Session Fixation of CSRF tokens

    Affected: from 2.0.0, fixed in 4.4.50; from 5.0.0, fixed in 5.4.20; from 6.0.0, fixed in 6.0.20; from 6.1.0, fixed in 6.1.12; from 6.2.0, fixed in 6.2.6.

  • CVE-2021-41268Medium 6.5

    Cookie persistence in Symfony

    Affected: from 5.3.0, fixed in 5.3.12.

  • The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before…

    Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.3.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11.

  • An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before…

    Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11.