CVE-2018-11406 — Vulnerability in symfony/security-http — CVE Details
HIGH
Symfony CSRF Token Fixation
Published May 14, 2022Updated February 18, 2024Source: osv
Summary
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
Advisory Timeline
- First published May 14, 2022 (1612 days ago).
- Last revised February 18, 2024 — 645 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
Composer
Update symfony/security-http to 4.0.11 or latercomposer require "symfony/security-http:^4.0.11"
Composer
Update symfony/symfony to 3.4.11 or latercomposer require "symfony/symfony:^3.4.11"
Composer
Update symfony/symfony to 4.0.11 or latercomposer require "symfony/symfony:^4.0.11"
Composer
Update symfony/security-http to 2.8.41 or latercomposer require "symfony/security-http:^2.8.41"
Composer
Update symfony/symfony to 2.8.41 or latercomposer require "symfony/symfony:^2.8.41"
Composer
Update symfony/security-bundle to 3.3.17 or latercomposer require "symfony/security-bundle:^3.3.17"
Composer
Update symfony/security to 3.4.11 or latercomposer require "symfony/security:^3.4.11"
Composer
Update symfony/security-http to 2.7.48 or latercomposer require "symfony/security-http:^2.7.48"
Composer
Update symfony/security to 2.7.48 or latercomposer require "symfony/security:^2.7.48"
Composer
Update symfony/security-bundle to 2.7.48 or latercomposer require "symfony/security-bundle:^2.7.48"
Composer
Update symfony/symfony to 3.3.17 or latercomposer require "symfony/symfony:^3.3.17"
Composer
Update symfony/security-bundle to 2.8.41 or latercomposer require "symfony/security-bundle:^2.8.41"
Composer
Update symfony/security to 3.3.17 or latercomposer require "symfony/security:^3.3.17"
Composer
Update symfony/security-bundle to 4.0.11 or latercomposer require "symfony/security-bundle:^4.0.11"
Composer
Update symfony/security to 2.8.41 or latercomposer require "symfony/security:^2.8.41"
Composer
Update symfony/symfony to 2.7.48 or latercomposer require "symfony/symfony:^2.7.48"
Composer
Update symfony/security-http to 3.3.17 or latercomposer require "symfony/security-http:^3.3.17"
Composer
Update symfony/security-bundle to 3.4.11 or latercomposer require "symfony/security-bundle:^3.4.11"
Composer
Update symfony/security to 4.0.11 or latercomposer require "symfony/security:^4.0.11"
Composer
Update symfony/security-http to 3.4.11 or latercomposer require "symfony/security-http:^3.4.11"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (20)
Affects 1 ecosystem: packagist (4).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| symfony/security-http | packagist | v4.0.0, v4.0.1, v4.0.10, v4.0.2 (+7 more) | 4.0.11 |
| symfony/symfony | packagist | v3.4.0, v3.4.1, v3.4.10, v3.4.2 (+7 more) | 3.4.11 |
| symfony/symfony | packagist | v4.0.0, v4.0.1, v4.0.10, v4.0.2 (+7 more) | 4.0.11 |
| symfony/security-http | packagist | v2.8.0, v2.8.1, v2.8.10, v2.8.11 (+37 more) | 2.8.41 |
| symfony/symfony | packagist | v2.8.0, v2.8.1, v2.8.10, v2.8.11 (+37 more) | 2.8.41 |
| symfony/security-bundle | packagist | v3.0.0, v3.0.1, v3.0.2, v3.0.3 (+56 more) | 3.3.17 |
| symfony/security | packagist | v3.4.0, v3.4.1, v3.4.10, v3.4.2 (+7 more) | 3.4.11 |
| symfony/security-http | packagist | v2.7.0, v2.7.1, v2.7.10, v2.7.11 (+44 more) | 2.7.48 |
| symfony/security | packagist | v2.7.0, v2.7.1, v2.7.10, v2.7.11 (+44 more) | 2.7.48 |
| symfony/security-bundle | packagist | v2.7.0, v2.7.1, v2.7.10, v2.7.11 (+44 more) | 2.7.48 |
| symfony/symfony | packagist | v3.0.0, v3.0.1, v3.0.2, v3.0.3 (+56 more) | 3.3.17 |
| symfony/security-bundle | packagist | v2.8.0, v2.8.1, v2.8.10, v2.8.11 (+37 more) | 2.8.41 |
| symfony/security | packagist | v3.0.0, v3.0.1, v3.0.2, v3.0.3 (+56 more) | 3.3.17 |
| symfony/security-bundle | packagist | v4.0.0, v4.0.1, v4.0.10, v4.0.2 (+7 more) | 4.0.11 |
| symfony/security | packagist | v2.8.0, v2.8.1, v2.8.10, v2.8.11 (+37 more) | 2.8.41 |
| symfony/symfony | packagist | v2.7.0, v2.7.1, v2.7.10, v2.7.11 (+44 more) | 2.7.48 |
| symfony/security-http | packagist | v3.0.0, v3.0.1, v3.0.2, v3.0.3 (+56 more) | 3.3.17 |
| symfony/security-bundle | packagist | v3.4.0, v3.4.1, v3.4.10, v3.4.2 (+7 more) | 3.4.11 |
| symfony/security | packagist | v4.0.0, v4.0.1, v4.0.10, v4.0.2 (+7 more) | 4.0.11 |
| symfony/security-http | packagist | v3.4.0, v3.4.1, v3.4.10, v3.4.2 (+7 more) | 3.4.11 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-352Cross-Site Request Forgery (CSRF)MITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-11406ADVISORY
- https://github.com/symfony/symfony/commit/319e1bdd43979d9c1559497de8d69adea28ab8d1WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2018-11406.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11406.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11406.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11406.yamlWEB
- https://github.com/symfony/symfonyPACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJVWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBWWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WHWEB
- https://symfony.com/blog/cve-2018-11406-csrf-token-fixationWEB
- https://symfony.com/cve-2018-11406WEB
- https://www.debian.org/security/2018/dsa-4262WEB
Frequently Asked Questions
- What is CVE-2018-11406?
- Symfony CSRF Token Fixation This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
- How do I check if my project is affected by CVE-2018-11406?
- CVE-2018-11406 affects symfony/security-http, symfony/symfony and symfony/security-bundle (and 1 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2018-11406 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
8.8
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-g4g7-q726-v5hg
Related CVEs
- CVE-2019-10910CRITICAL
Symfony Service IDs Allow Injection
- CVE-2017-11365CRITICAL
Symfony Incorrect Access Control
- CVE-2026-45075HIGH
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
- CVE-2026-45077HIGH
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
- CVE-2026-45063HIGH
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
- CVE-2024-51736HIGH
Symfony vulnerable to command execution hijack on Windows with Process class
- CVE-2014-6072HIGH
Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
- CVE-2026-48784MEDIUM
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies