PT-2023-7208 · Symfony · Symfony

🗓️ 10 Nov 2023 00:00:00Reported by Positive TechnologiesType

Symfony session fixation in SessionStrategyListener when login token changes; upgrade versions or regenerate session ID.

Reporter	Title	Published	Views	Family All 19
CNNVD	Symfony Security Vulnerabilities	10 Nov 202300:00	–	cnnvd
CVE	CVE-2023-46733	10 Nov 202317:09	–	cve
Cvelist	CVE-2023-46733 Symfony possible session fixation vulnerability	10 Nov 202317:09	–	cvelist
Debian CVE	CVE-2023-46733	10 Nov 202317:09	–	debiancve
EUVD	EUVD-2023-2996	3 Oct 202520:07	–	euvd
Friends Of PHP	CVE-2023-46733: Possible session fixation	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	CVE-2023-46733: Potential XSS in WebhookController	1 Jan 197000:00	–	friendsofphp
Github Security Blog	Symfony possible session fixation vulnerability	12 Nov 202315:51	–	github
NVD	CVE-2023-46733	10 Nov 202318:15	–	nvd
OSV	BIT-SYMFONY-2023-46733	6 Mar 202411:06	–	osv

Source	Link
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2023-46733.yaml
github	www.github.com/symfony/symfony/security/advisories/GHSA-m2wj-r6g3-fxfx
github	www.github.com/symfony/symfony/commit/dc356499d5ceb86f7cf2b4c7f032eca97061ed74
github	www.github.com/symfony/symfony/commit/7467bd7e3f888b333102bc664b5e02ef1e7f88b9
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2023-46733
osv	www.osv.dev/vulnerability/BIT-symfony-2023-46733
bdu	www.bdu.fstec.ru/vul/2023-08236
security-tracker	www.security-tracker.debian.org/tracker/CVE-2023-46733
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-46733

06 Mar 2024 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 26.8

CVSS 3.16.5

EPSS0.01316

SSVC