Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-36611

Date: November 28, 2024

In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.

Language: PHP

Severity Score

Related Resources (8)

https://github.com/symfony/symfony/commit/a804ca15fcad279d7727b91d12a667fd5b925995
https://github.com/symfony/symfony/issues/59077#issuecomment-2513935018
https://gist.github.com/1047524396/3581425e0911b716cf8ce4fa30e41e6c
https://github.com/symfony/symfony/blob/v7.0.7/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php#L132
https://security-tracker.debian.org/tracker/CVE-2024-36611
https://github.com/github/advisory-database/pull/5046
https://nvd.nist.gov/vuln/detail/CVE-2024-36611
https://www.mend.io/vulnerability-database/CVE-2024-36611

Severity Score

Weakness Type (CWE)

Improper Authentication

CWE-287

Incorrect Authorization

CWE-863

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us