Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3493 advisory.

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The     ability to enumerate users was possible without relevant permissions due to different handling depending     on whether the user existed or not when attempting to use the switch users functionality. We now ensure     that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user     does not exist. The patch for this issue is available for branch 3.4. (CVE-2021-21424)

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The     Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and     returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might     contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill     stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's     session. This issue has been patched and is available for branch 4.4. (CVE-2022-24894)

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When     authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of     session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site     attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.
    This issue has been fixed in the 4.4 branch. (CVE-2022-24895)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-74b702f058 advisory.

    **Version  4.4.50** (2023-02-01)

     * **security cve-2022-24895** [Security/Http] Remove CSRF tokens from storage on successful login     (nicolas-grekas)
     * **security cve-2022-24894** [HttpKernel] Remove private headers before storing responses with HttpCache     (nicolas-grekas)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-aecde14648 advisory.

    **Version  4.4.50** (2023-02-01)

     * **security cve-2022-24895** [Security/Http] Remove CSRF tokens from storage on successful login     (nicolas-grekas)
     * **security cve-2022-24894** [HttpKernel] Remove private headers before storing responses with HttpCache     (nicolas-grekas)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
178174	Debian DLA-3493-1 : symfony - LTS security update	Nessus	Debian Local Security Checks	high
171375	Fedora 37 : php-symfony4 (2023-74b702f058)	Nessus	Fedora Local Security Checks	high
171373	Fedora 36 : php-symfony4 (2023-aecde14648)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2022-24895

high

Tenable Plugins

high

high

high