CVE-2024-50341: symfony Improper Authentication
Vulnerability summary
CVE-2024-50341 is a low (CVSS 3.1) Improper Authentication vulnerability in symfony. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 06-11-2024PublishedVulnerability first disclosed.
- 07-11-2024Last modifiedVulnerability information updated.
Description
symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- NVDNIST3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
0.00 pp
From 0.31% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- symfony< 6.4.10+dfsg-1
Symfony1 product
- symfony≥ 6.2.0, < 6.4.10 | ≥ 7.0.0, < 7.0.10 | ≥ 7.1.0, < 7.1.3
Ubuntu1 product
- symfony< 6.4.5+dfsg-3ubuntu3+esm1
3 vendors · 3 products
