CVE-2024-36611

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36611
In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/1047524396/3581425e0911b716cf8ce4fa30e41e6c
https://github.com/github/advisory-database/pull/5046
https://github.com/symfony/symfony/blob/v7.0.7/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php#L132
https://github.com/symfony/symfony/commit/a804ca15fcad279d7727b91d12a667fd5b925995
https://github.com/symfony/symfony/issues/59077#issuecomment-2513935018
Configurations

No configuration.

History

03 Dec 2024, 21:15

Type Values Removed Values Added
References
  • () https://github.com/github/advisory-database/pull/5046 -
  • () https://github.com/symfony/symfony/issues/59077#issuecomment-2513935018 -
Summary (en) In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. (en) In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.

03 Dec 2024, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
Summary
  • (es) En Symfony v7.07, se identificó una vulnerabilidad de seguridad en el componente FormLoginAuthenticator, que no podía gestionar adecuadamente los casos en los que el campo de nombre de usuario o contraseña de una solicitud de inicio de sesión estaba vacío. Este fallo podría generar varios riesgos de seguridad, incluido el manejo inadecuado de la lógica de autenticación o la denegación de servicio.
CWE CWE-863

29 Nov 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-29 19:15

Updated : 2024-12-03 21:15

NVD link : CVE-2024-36611

Mitre link : CVE-2024-36611

CVE.ORG link : CVE-2024-36611

JSON object : View

Products Affected

No product.

CWE
CWE-863

Incorrect Authorization