CVE-2015-8124 Symfony Session Fixation Vulnerability
Remote attackers can hijack web sessions via session fixation in the Remember Me feature, requiring user interaction to exploit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-8124?
CVE-2015-8124 is a medium-severity authentication bypass vulnerability in Sensiolabs Symfony, published on 7 Dec 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.
Which versions are affected by CVE-2015-8124?
16 open source packages ship an affected version, including symfony/security, symfony/security-http and symfony/symfony. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/security Packagist | From 2.3.0 | 2.3.35 |
symfony/security Packagist | From 2.3.0 | 2.3.35 |
symfony/security Packagist | From 2.4.0 | 2.6.12 |
symfony/security Packagist | From 2.4.0 | 2.6.12 |
symfony/security Packagist | From 2.7.0 | 2.7.7 |
symfony/security Packagist | From 2.7.0 | 2.7.7 |
10 more packages
symfony/security-http Packagist | From 2.4.0 | 2.6.12 |
symfony/security-http Packagist | From 2.4.0 | 2.6.12 |
symfony/security-http Packagist | From 2.7.0 | 2.7.7 |
symfony/security-http Packagist | From 2.7.0 | 2.7.7 |
symfony/symfony Packagist | From 2.3.0 | 2.3.35 |
symfony/symfony Packagist | From 2.3.0 | 2.3.35 |
symfony/symfony Packagist | From 2.4.0 | 2.6.12 |
symfony/symfony Packagist | From 2.4.0 | 2.6.12 |
symfony/symfony Packagist | From 2.7.0 | 2.7.7 |
symfony/symfony Packagist | From 2.7.0 | 2.7.7 |
Products include Sensiolabs Symfony.
How do I fix CVE-2015-8124?
Upgrade symfony/security to a fixed version for your release line: 2.3.35, 2.6.12 or 2.7.7.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2015-8124 being exploited?
There is no known exploitation of CVE-2015-8124 in the wild and no public exploit code.
Other vulnerabilities in Sensiolabs Symfony
Sources
Also known as DEBIAN-CVE-2015-8124, GHSA-j5jh-hpr4-h332.