CVE-2022-24895: sensiolabs symfony Session Fixation
Vulnerability summary
CVE-2022-24895 is a high (CVSS 8.8) Session Fixation vulnerability in sensiolabs symfony. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 03-02-2023PublishedVulnerability first disclosed.
- 10-03-2025Last modifiedVulnerability information updated.
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.79% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
- CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Affected systems
Debian1 product
- symfony< 5.4.20+dfsg-1
Sensiolabs1 product
- symfony≥ 2.0.0, < 4.4.50 | ≥ 5.0.0, < 5.4.20 | ≥ 6.0.0, < 6.0.20 | ≥ 6.1.0, < 6.1.12 | ≥ 6.2.0, < 6.2.6
Symfony1 product
- symfony≥ 2.0.0, < 4.4.50 | ≥ 5.0.0, < 5.4.20 | ≥ 6.0.0, < 6.0.20 | ≥ 6.1.0, < 6.1.12 | ≥ 6.2.0, < 6.2.6
Ubuntu1 product
- symfonyAll versions (No fix recorded) | < 4.3.8+dfsg-1ubuntu1+esm2 | < 5.4.4+dfsg-1ubuntu8+esm1
4 vendors · 4 products
References
9 links- github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67mX Refsource CONFIRMPatchThird Party Advisory
- github.com/symfony/security-bundle/commit/076fd2088ada33d760758d98ff07ddedbf567946X Refsource MISCPatch
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2022-24895.yamlX Refsource MISCIssue Tracking
