Skip to content
RequestGuard Vulnerabilities
Pricing

symfony/security-bundle

Provides a tight integration of the Security component into the Symfony full-stack framework

Composer latest 8.1.7 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

8.1.7

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

High

5 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

5

Symfony CSRF Token Fixation

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.48ECOSYSTEM: introduced 2.8.0; fixed 2.8.41ECOSYSTEM: introduced 3.0.0; fixed 3.3.17ECOSYSTEM: introduced 3.4.0; fixed 3.4.11ECOSYSTEM: introduced 4.0.0; fixed 4.0.11

Fixed versions: 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11

Symfony vulnerable to Session Fixation of CSRF tokens

Affected range

ECOSYSTEM: introduced 2.0.0; fixed 4.4.50ECOSYSTEM: introduced 5.0.0; fixed 5.4.20ECOSYSTEM: introduced 6.0.0; fixed 6.0.20ECOSYSTEM: introduced 6.1.0; fixed 6.1.12ECOSYSTEM: introduced 6.2.0; fixed 6.2.6

Fixed versions: 4.4.50, 5.4.20, 6.0.20, 6.1.12, 6.2.6

Symfony Open Redirect

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.48ECOSYSTEM: introduced 2.8.0; fixed 2.8.41ECOSYSTEM: introduced 3.3.0; fixed 3.3.17ECOSYSTEM: introduced 3.4.0; fixed 3.4.11ECOSYSTEM: introduced 4.0.0; fixed 4.0.11

Fixed versions: 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11

Symfony's `Security::login` does not take into account custom `user_checker`

Affected range

ECOSYSTEM: introduced 6.2.0; fixed 6.4.10ECOSYSTEM: introduced 7.0.0; fixed 7.0.10ECOSYSTEM: introduced 7.1.0; fixed 7.1.3>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.10|>=7.0.0,<7.0.10|>=7.1.0,<7.1.3

Fixed versions: 6.4.10, 7.0.10, 7.1.3