Lucene search

[email protected]CVE-2022-23601

HistoryFeb 01, 2022 - 1:15 p.m.

CVE-2022-23601

2022-02-0113:15:10

CWE-352

[email protected]

web.nvd.nist.gov

symfony

php framework

web applications

console applications

php components

csrf

protection mechanism

vulnerability

patch versions

security update

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.9%

JSON

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled. In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks. This issue has been resolved in the patch versions listed and users are advised to update. There are no known workarounds for this issue.

Affected configurations

NVD

Node

sensiolabssymfonyRange<5.3.15

sensiolabssymfonyRange5.4.0–5.4.4

sensiolabssymfonyRange6.0.0–6.0.4

CPENameOperatorVersion
sensiolabs:symfonysensiolabs symfonylt5.3.15
sensiolabs:symfonysensiolabs symfonylt5.4.4
sensiolabs:symfonysensiolabs symfonylt6.0.4

CPE	Name	Operator	Version
sensiolabs:symfony	sensiolabs symfony	lt	5.3.15
sensiolabs:symfony	sensiolabs symfony	lt	5.4.4
sensiolabs:symfony	sensiolabs symfony	lt	6.0.4

CNA Affected

[
  {
    "product": "symfony",
    "vendor": "symfony",
    "versions": [
      {
        "status": "affected",
        "version": "5.3.14"
      },
      {
        "status": "affected",
        "version": "5.4.3"
      },
      {
        "status": "affected",
        "version": "6.0.3"
      }
    ]
  }
]