Improper authentication in Symfony

🗓️ 12 Feb 2020 18:45:08Reported by GitHub Advisory DatabaseType

Improper authentication vulnerability in Symfon

Reporter	Title	Published	Views	Family All 64
FreeBSD	drupal -- Drupal core - Moderately critical	17 Apr 201900:00	–	freebsd
BDU FSTEC	The vulnerability of the `generateCookieHash` function in the Symfony/security component of the Symfony software development and web application management platform allows attackers to bypass authentication procedures.	27 Feb 202000:00	–	bdu_fstec
Circl	CVE-2019-10911	16 May 201922:51	–	circl
CVE	CVE-2019-10911	16 May 201921:29	–	cve
Cvelist	CVE-2019-10911	16 May 201921:29	–	cvelist
Debian	[SECURITY] [DLA 1778-1] symfony security update	6 May 201919:15	–	debian
Debian	[SECURITY] [DSA 4441-1] symfony security update	10 May 201906:26	–	debian
Debian	[SECURITY] [DSA 4441-1] symfony security update	10 May 201906:26	–	debian
Debian CVE	CVE-2019-10911	16 May 201921:29	–	debiancve
Tenable Nessus	Debian DLA-1778-1 : symfony security update	7 May 201900:00	–	nessus

Vulners

Node

symfony symfonyRange4.2.0–4.2.7composer

symfony symfonyRange4.0.0–4.1.12composer

symfony symfonyRange3.0.0–3.4.26composer

symfony symfonyRange2.8.0–2.8.50composer

symfony symfonyRange2.7.0–2.7.51composer

symfony securityRange4.2.0–4.2.7composer

symfony securityRange4.0.0–4.1.12composer

symfony securityRange3.0.0–3.4.26composer

symfony securityRange2.8.0–2.8.50composer

symfony securityRange2.7.0–2.7.51composer

symfony security-httpRange4.2.0–4.2.7composer

symfony security-httpRange4.0.0–4.1.12composer

symfony security-httpRange3.0.0–3.4.26composer

symfony security-httpRange2.8.0–2.8.50composer

symfony security-httpRange2.7.0–2.7.51composer

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-10911
github	www.github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-10911.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2019-10911.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10911.yaml
symfony	www.symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash
symfony	www.symfony.com/cve-2019-10911
synology	www.synology.com/security/advisory/Synology_SA_19_19
github	www.github.com/advisories/GHSA-cchx-mfrc-fwqr

01 Feb 2023 05:02Current

4.6Medium risk

Vulners AI Score4.6

CVSS 26

CVSS 3.17.5

EPSS0.01243