CVE-2024-36611 Auth bypass in n/a
The Symfony FormLoginAuthenticator component may mishandle empty credentials, potentially allowing authentication bypass or denial of service, though the vendor disputes this.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36611?
CVE-2024-36611 is a high-severity authentication bypass vulnerability in n/a, published on 29 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.
Weakness: CWE-863
Which versions are affected by CVE-2024-36611?
How do I fix CVE-2024-36611?
No fix published yet.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-36611 being exploited?
There is no known exploitation of CVE-2024-36611 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-36611.