SB2023020144 - Multiple vulnerabilities in symfony

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Cross-site request forgery (CVE-ID: CVE-2022-24895)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

2) Session Fixation (CVE-ID: CVE-2022-24894)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the cookie headers are stored in HttpCache. A remote attacker can retrieve the victim's session.

Remediation

Install update from vendor's website.

References

• https://github.com/symfony/symfony/releases/tag/v5.4.20
• https://github.com/symfony/symfony/releases/tag/v6.0.20
• https://github.com/symfony/symfony/releases/tag/v6.1.12
• https://github.com/symfony/symfony/releases/tag/v6.2.6
• https://github.com/symfony/symfony/releases/tag/v4.4.50