CVE-2018-11385 Information

Description

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48 2.8.x before 2.8.41 3.3.x before 3.3.17 3.4.x before 3.4.11 and 4.0.x before 4.0.11. A session fixation vulnerability within the \Guard\ login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.

CVSS Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/ https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authentication https://www.debian.org/security/2018/dsa-4262

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.1