SB2021112510 - Multiple vulnerabilities n Symfony

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021112510

SB2021112510 - Multiple vulnerabilities n Symfony

Published: November 25, 2021

Security Bulletin ID SB2021112510
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Session Fixation (CVE-ID: CVE-2021-41268)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to the cookie is not invalidated anymore when the user changes its password. A remote authenticated attacker can maintain their access to the account even if the password is changed.


2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2021-41267)

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.


3) Improper Neutralization of Formula Elements in a CSV File (CVE-ID: CVE-2021-41270)

The vulnerability allows a remote attacker to compromsie the target system.

The vulnerability exists due to improper neutralization of formula elements in a CSV File. A remote authenticated attacker can inject formulas into the tag data.


Remediation

Install update from vendor's website.

References