CVE-2015-8124 Symfony Session Fixation Vulnerability
MediumCVSS 6.8
EPSS 2.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony/symfony(Packagist) | >= 2.3.0, < 2.3.35 | 2.3.35 |
| symfony/symfony(Packagist) | = v2.3.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.10 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.11 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.12 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.13 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.14 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.15 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.16 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.17 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.18 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.19 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.2 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.20 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.21 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.22 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.23 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.24 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.25 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.26 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.27 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.28 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.29 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.3 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony/symfony(Packagist) | = v2.3.30 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.31 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.32 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.33 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.34 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.4 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.5 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.6 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.7 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.8 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.9 | No fix listed |
| symfony/symfony(Packagist) | >= 2.4.0, < 2.6.12 | 2.6.12 |
| symfony/symfony(Packagist) | = v2.4.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.4.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.4.10 | No fix listed |
| symfony/symfony(Packagist) | = v2.4.2 | No fix listed |
| symfony/symfony(Packagist) | = v2.4.3 | No fix listed |
| symfony/symfony(Packagist) | = v2.4.4 | No fix listed |
| symfony/symfony(Packagist) | = v2.4.5 | No fix listed |
| symfony/symfony(Packagist) | = v2.4.6 | No fix listed |
| symfony/symfony(Packagist) | = v2.4.7 | No fix listed |
| symfony/symfony(Packagist) | = v2.4.8 | No fix listed |
| symfony/symfony(Packagist) | = v2.4.9 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.0-BETA1 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.0-BETA2 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.0-RC1 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.10 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.11 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.12 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.2 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.3 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.4 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.5 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.6 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.7 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.8 | No fix listed |
| symfony/symfony(Packagist) | = v2.5.9 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.0-BETA1 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.0-BETA2 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.10 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.11 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.2 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.3 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.4 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.5 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.6 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.7 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.8 | No fix listed |
| symfony/symfony(Packagist) | = v2.6.9 | No fix listed |
| symfony/symfony(Packagist) | >= 2.7.0, < 2.7.7 | 2.7.7 |
| symfony/symfony(Packagist) | = v2.7.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.2 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.3 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.4 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.5 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.6 | No fix listed |
| symfony/security-http(Packagist) | >= 2.4.0, < 2.6.12 | 2.6.12 |
| symfony/security-http(Packagist) | = v2.4.0 | No fix listed |
| symfony/security-http(Packagist) | = v2.4.1 | No fix listed |
| symfony/security-http(Packagist) | = v2.4.10 | No fix listed |
| symfony/security-http(Packagist) | = v2.4.2 | No fix listed |
| symfony/security-http(Packagist) | = v2.4.3 | No fix listed |
| symfony/security-http(Packagist) | = v2.4.4 | No fix listed |
| symfony/security-http(Packagist) | = v2.4.5 | No fix listed |
| symfony/security-http(Packagist) | = v2.4.6 | No fix listed |
| symfony/security-http(Packagist) | = v2.4.7 | No fix listed |
| symfony/security-http(Packagist) | = v2.4.8 | No fix listed |
| symfony/security-http(Packagist) | = v2.4.9 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.0 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.0-BETA1 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.0-BETA2 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.0-RC1 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.1 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.10 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.11 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.12 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.2 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.3 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.4 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.5 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.6 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.7 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.8 | No fix listed |
| symfony/security-http(Packagist) | = v2.5.9 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.0 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.0-BETA1 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.0-BETA2 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.1 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.10 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.11 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.2 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.3 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.4 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.5 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.6 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.7 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.8 | No fix listed |
| symfony/security-http(Packagist) | = v2.6.9 | No fix listed |
| symfony/security-http(Packagist) | >= 2.7.0, < 2.7.7 | 2.7.7 |
| symfony/security-http(Packagist) | = v2.7.0 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.1 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.2 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.3 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.4 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.5 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.6 | No fix listed |
| symfony/security(Packagist) | >= 2.3.0, < 2.3.35 | 2.3.35 |
| symfony/security(Packagist) | = v2.3.0 | No fix listed |
| symfony/security(Packagist) | = v2.3.1 | No fix listed |
| symfony/security(Packagist) | = v2.3.10 | No fix listed |
| symfony/security(Packagist) | = v2.3.11 | No fix listed |
| symfony/security(Packagist) | = v2.3.12 | No fix listed |
| symfony/security(Packagist) | = v2.3.13 | No fix listed |
| symfony/security(Packagist) | = v2.3.14 | No fix listed |
| symfony/security(Packagist) | = v2.3.15 | No fix listed |
| symfony/security(Packagist) | = v2.3.16 | No fix listed |
| symfony/security(Packagist) | = v2.3.17 | No fix listed |
| symfony/security(Packagist) | = v2.3.18 | No fix listed |
| symfony/security(Packagist) | = v2.3.19 | No fix listed |
| symfony/security(Packagist) | = v2.3.2 | No fix listed |
| symfony/security(Packagist) | = v2.3.20 | No fix listed |
| symfony/security(Packagist) | = v2.3.21 | No fix listed |
| symfony/security(Packagist) | = v2.3.22 | No fix listed |
| symfony/security(Packagist) | = v2.3.23 | No fix listed |
| symfony/security(Packagist) | = v2.3.24 | No fix listed |
| symfony/security(Packagist) | = v2.3.25 | No fix listed |
| symfony/security(Packagist) | = v2.3.26 | No fix listed |
| symfony/security(Packagist) | = v2.3.27 | No fix listed |
| symfony/security(Packagist) | = v2.3.28 | No fix listed |
| symfony/security(Packagist) | = v2.3.29 | No fix listed |
| symfony/security(Packagist) | = v2.3.3 | No fix listed |
| symfony/security(Packagist) | = v2.3.30 | No fix listed |
| symfony/security(Packagist) | = v2.3.31 | No fix listed |
| symfony/security(Packagist) | = v2.3.32 | No fix listed |
| symfony/security(Packagist) | = v2.3.33 | No fix listed |
| symfony/security(Packagist) | = v2.3.34 | No fix listed |
| symfony/security(Packagist) | = v2.3.4 | No fix listed |
| symfony/security(Packagist) | = v2.3.5 | No fix listed |
| symfony/security(Packagist) | = v2.3.6 | No fix listed |
| symfony/security(Packagist) | = v2.3.7 | No fix listed |
| symfony/security(Packagist) | = v2.3.8 | No fix listed |
| symfony/security(Packagist) | = v2.3.9 | No fix listed |
| symfony/security(Packagist) | >= 2.4.0, < 2.6.12 | 2.6.12 |
| symfony/security(Packagist) | = v2.4.0 | No fix listed |
| symfony/security(Packagist) | = v2.4.1 | No fix listed |
| symfony/security(Packagist) | = v2.4.10 | No fix listed |
| symfony/security(Packagist) | = v2.4.2 | No fix listed |
| symfony/security(Packagist) | = v2.4.3 | No fix listed |
| symfony/security(Packagist) | = v2.4.4 | No fix listed |
| symfony/security(Packagist) | = v2.4.5 | No fix listed |
| symfony/security(Packagist) | = v2.4.6 | No fix listed |
| symfony/security(Packagist) | = v2.4.7 | No fix listed |
| symfony/security(Packagist) | = v2.4.8 | No fix listed |
| symfony/security(Packagist) | = v2.4.9 | No fix listed |
| symfony/security(Packagist) | = v2.5.0 | No fix listed |
| symfony/security(Packagist) | = v2.5.0-BETA1 | No fix listed |
| symfony/security(Packagist) | = v2.5.0-BETA2 | No fix listed |
| symfony/security(Packagist) | = v2.5.0-RC1 | No fix listed |
| symfony/security(Packagist) | = v2.5.1 | No fix listed |
| symfony/security(Packagist) | = v2.5.10 | No fix listed |
| symfony/security(Packagist) | = v2.5.11 | No fix listed |
| symfony/security(Packagist) | = v2.5.12 | No fix listed |
| symfony/security(Packagist) | = v2.5.2 | No fix listed |
| symfony/security(Packagist) | = v2.5.3 | No fix listed |
| symfony/security(Packagist) | = v2.5.4 | No fix listed |
| symfony/security(Packagist) | = v2.5.5 | No fix listed |
| symfony/security(Packagist) | = v2.5.6 | No fix listed |
| symfony/security(Packagist) | = v2.5.7 | No fix listed |
| symfony/security(Packagist) | = v2.5.8 | No fix listed |
| symfony/security(Packagist) | = v2.5.9 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com exploit
- github.com exploit
- github.com exploit
- symfony.com vendor-advisory
- symfony.com
- web.archive.org
- web.archive.org
- FEDORA-2015-0efcb5fbc5 vendor-advisory
- FEDORA-2015-0b89738311 vendor-advisory
- 20151222 [RT-SA-2015-013] Symfony PHP Framework: Session Fixation In "Remember Me" Login Functionality mailing-list
- DSA-3402 vendor-advisory
- Debian Security Tracker CVE-2015-8124 vendor-advisory
- github.com
- 20151222 [RT-SA-2015-013] Symfony PHP Framework: Session Fixation In "Remember Me" Login Functionality mailing-list
- 77694 vdb-entry