Session Fixation

symphonycms/symphony-2 is vulnerable to session fixation. The vulnerability exists as it does not regenerate the user’s PHPSESSID cookie value upon a successful authentication. If a user’s PHPSESSID cookie value can be modified by means of application logic or another vulnerability, an attacker will be able to fix the user’s session token value with a value of choice and gain access to the application as the user when the user successfully authenticates to the application.