CVE-2022-24894

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-24894
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb Patch
https://github.com/symfony/symfony/security/advisories/GHSA-h7vf-5wrv-9fhv Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html Mailing List
https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb Patch
https://github.com/symfony/symfony/security/advisories/GHSA-h7vf-5wrv-9fhv Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
History

10 Apr 2025, 20:54

Type Values Removed Values Added
References () https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html - () https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html - Mailing List
CWE NVD-CWE-noinfo

13 Feb 2025, 17:15

Type Values Removed Values Added
Summary (en) Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4. (en) Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4.

21 Nov 2024, 06:51

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 5.9
References () https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb - Patch () https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb - Patch
References () https://github.com/symfony/symfony/security/advisories/GHSA-h7vf-5wrv-9fhv - Third Party Advisory () https://github.com/symfony/symfony/security/advisories/GHSA-h7vf-5wrv-9fhv - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html - () https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html -

12 Jul 2023, 01:15

Type Values Removed Values Added
Summary Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4. Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4.
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html -
Information

Published : 2023-02-03 22:15

Updated : 2025-04-10 20:54

NVD link : CVE-2022-24894

Mitre link : CVE-2022-24894

CVE.ORG link : CVE-2022-24894

JSON object : View

Products Affected

sensiolabs

  • symfony
CWE
CWE-285

Improper Authorization

NVD-CWE-noinfo