sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2018-11406 Symfony CSRF Token Fixation

High 8.8 Published Updated

Attackers can fixate CSRF tokens if session invalidation is disabled during logout, bypassing CSRF protections in Symfony applications.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
A user has to click or open something
Fix
Available

What is CVE-2018-11406?

CVE-2018-11406 is a high-severity vulnerability in Debian Debian Linux, published on 13 Jun 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.

Weakness: CWE-352

Which versions are affected by CVE-2018-11406?

40 open source packages ship an affected version, including symfony/security, symfony/security-bundle and symfony/security-http. It affects 2 products.

PackageAffectedFixed in
symfony/security PackagistFrom 2.7.02.7.48
symfony/security PackagistFrom 2.7.02.7.48
symfony/security PackagistFrom 2.8.02.8.41
symfony/security PackagistFrom 2.8.02.8.41
symfony/security PackagistFrom 3.0.03.3.17
symfony/security PackagistFrom 3.0.03.3.17
34 more packages
symfony/security PackagistFrom 3.4.03.4.11
symfony/security PackagistFrom 3.4.03.4.11
symfony/security PackagistFrom 4.0.04.0.11
symfony/security PackagistFrom 4.0.04.0.11
symfony/security-bundle PackagistFrom 2.7.02.7.48
symfony/security-bundle PackagistFrom 2.7.02.7.48
symfony/security-bundle PackagistFrom 2.8.02.8.41
symfony/security-bundle PackagistFrom 2.8.02.8.41
symfony/security-bundle PackagistFrom 3.0.03.3.17
symfony/security-bundle PackagistFrom 3.0.03.3.17
symfony/security-bundle PackagistFrom 3.4.03.4.11
symfony/security-bundle PackagistFrom 3.4.03.4.11
symfony/security-bundle PackagistFrom 4.0.04.0.11
symfony/security-bundle PackagistFrom 4.0.04.0.11
symfony/security-http PackagistFrom 2.7.02.7.48
symfony/security-http PackagistFrom 2.7.02.7.48
symfony/security-http PackagistFrom 2.8.02.8.41
symfony/security-http PackagistFrom 2.8.02.8.41
symfony/security-http PackagistFrom 3.0.03.3.17
symfony/security-http PackagistFrom 3.0.03.3.17
symfony/security-http PackagistFrom 3.4.03.4.11
symfony/security-http PackagistFrom 3.4.03.4.11
symfony/security-http PackagistFrom 4.0.04.0.11
symfony/security-http PackagistFrom 4.0.04.0.11
symfony/symfony PackagistFrom 2.7.02.7.48
symfony/symfony PackagistFrom 2.7.02.7.48
symfony/symfony PackagistFrom 2.8.02.8.41
symfony/symfony PackagistFrom 2.8.02.8.41
symfony/symfony PackagistFrom 3.0.03.3.17
symfony/symfony PackagistFrom 3.0.03.3.17
symfony/symfony PackagistFrom 3.4.03.4.11
symfony/symfony PackagistFrom 3.4.03.4.11
symfony/symfony PackagistFrom 4.0.04.0.11
symfony/symfony PackagistFrom 4.0.04.0.11

Products include Debian Debian Linux, Sensiolabs Symfony.

How do I fix CVE-2018-11406?

Upgrade symfony/security to a fixed version for your release line: 2.7.48, 2.8.41, 3.3.17 or 3.4.11.

Is CVE-2018-11406 being exploited?

There is no known exploitation of CVE-2018-11406 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-11406, GHSA-g4g7-q726-v5hg, UBUNTU-CVE-2018-11406.

Is CVE-2018-11406 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free