CVE-2019-10911

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.

Published: May 17, 2019
Updated: May 9, 2024
CVE: CVE-2019-10911
GHSA: GHSA-cchx-mfrc-fwqr
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6
AV:N/AC:M/Au:S/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
sensiolabs / symfony	4.2.0	4.2.7
sensiolabs / symfony	4.1.0	4.1.12
sensiolabs / symfony	3.4.0	3.4.26
sensiolabs / symfony	2.8.0	2.8.50
sensiolabs / symfony	2.7.0	2.7.51
drupal / drupal	8.5.0	8.5.15
drupal / drupal	8.6.0	8.6.15
symfony / security-http	2.7.0	2.7.51
symfony / security-http	2.8.0	2.8.50
symfony / security-http	3.0.0	3.4.26
symfony / security-http	4.0.0	4.1.12
symfony / security-http	4.2.0	4.2.7
symfony / security	2.7.0	2.7.51
symfony / security	2.8.0	2.8.50
symfony / security	3.0.0	3.4.26
symfony / security	4.0.0	4.1.12
symfony / security	4.2.0	4.2.7
symfony / symfony	2.7.0	2.7.51
symfony / symfony	2.8.0	2.8.50
symfony / symfony	3.0.0	3.4.26
symfony / symfony	4.0.0	4.1.12
symfony / symfony	4.2.0	4.2.7

Vulnerability Database

CVE-2019-10911

Deep Security Visibility Without the Complexity