Home > Vulnerability Database > CVE-2015-8124

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2015-8124

Date: December 7, 2015

Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.

Language: PHP

Severity Score

3.1

Related Resources (16)

Url: http://seclists.org/fulldisclosure/2015/Dec/89

Url: http://www.debian.org/security/2015/dsa-3402

Url: https://github.com/symfony/symfony/pull/16631

Url: https://symfony.com/cve-2015-8124

Url: http://www.securityfocus.com/archive/1/537183/100/0/threaded

Url: https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8124.yaml

Url: http://www.securityfocus.com/bid/77694

Url: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2015-8124

Url: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html

Url: https://web.archive.org/web/20210125123853/http://www.securityfocus.com/bid/77694

Url: https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature

Url: https://web.archive.org/web/20201209020014/http://www.securityfocus.com/archive/1/537183/100/0/threaded

Url: https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8124.yaml

Url: https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8124.yaml

Url: https://www.mend.io/vulnerability-database/CVE-2015-8124

Severity Score

3.1

Weakness Type (CWE)

Session Fixation

CWE-384

CVSS v3.1

Base Score:	3.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	6.8
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Do you need more information?

Contact Us