CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2018-11406

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 41.7%

CVSS Severity

CVSS v3 Score 8.8

CVSS v2 Score 6.8

References

Products affected by CVE-2018-11406

Sensiolabs » Symfony » Version: 2.7.0

cpe:2.3:a:sensiolabs:symfony:2.7.0
Sensiolabs » Symfony » Version: 2.7.1

cpe:2.3:a:sensiolabs:symfony:2.7.1
Sensiolabs » Symfony » Version: 2.7.10

cpe:2.3:a:sensiolabs:symfony:2.7.10
Sensiolabs » Symfony » Version: 2.7.11

cpe:2.3:a:sensiolabs:symfony:2.7.11
Sensiolabs » Symfony » Version: 2.7.12

cpe:2.3:a:sensiolabs:symfony:2.7.12
Sensiolabs » Symfony » Version: 2.7.13

cpe:2.3:a:sensiolabs:symfony:2.7.13
Sensiolabs » Symfony » Version: 2.7.14

cpe:2.3:a:sensiolabs:symfony:2.7.14
Sensiolabs » Symfony » Version: 2.7.15

cpe:2.3:a:sensiolabs:symfony:2.7.15
Sensiolabs » Symfony » Version: 2.7.16

cpe:2.3:a:sensiolabs:symfony:2.7.16
Sensiolabs » Symfony » Version: 2.7.17

cpe:2.3:a:sensiolabs:symfony:2.7.17
Sensiolabs » Symfony » Version: 2.7.18

cpe:2.3:a:sensiolabs:symfony:2.7.18
Sensiolabs » Symfony » Version: 2.7.19

cpe:2.3:a:sensiolabs:symfony:2.7.19
Sensiolabs » Symfony » Version: 2.7.2

cpe:2.3:a:sensiolabs:symfony:2.7.2
Sensiolabs » Symfony » Version: 2.7.20

cpe:2.3:a:sensiolabs:symfony:2.7.20
Sensiolabs » Symfony » Version: 2.7.21

cpe:2.3:a:sensiolabs:symfony:2.7.21
Sensiolabs » Symfony » Version: 2.7.22

cpe:2.3:a:sensiolabs:symfony:2.7.22
Sensiolabs » Symfony » Version: 2.7.23

cpe:2.3:a:sensiolabs:symfony:2.7.23
Sensiolabs » Symfony » Version: 2.7.24

cpe:2.3:a:sensiolabs:symfony:2.7.24
Sensiolabs » Symfony » Version: 2.7.25

cpe:2.3:a:sensiolabs:symfony:2.7.25
Sensiolabs » Symfony » Version: 2.7.26

cpe:2.3:a:sensiolabs:symfony:2.7.26
Sensiolabs » Symfony » Version: 2.7.27

cpe:2.3:a:sensiolabs:symfony:2.7.27
Sensiolabs » Symfony » Version: 2.7.28

cpe:2.3:a:sensiolabs:symfony:2.7.28
Sensiolabs » Symfony » Version: 2.7.29

cpe:2.3:a:sensiolabs:symfony:2.7.29
Sensiolabs » Symfony » Version: 2.7.3

cpe:2.3:a:sensiolabs:symfony:2.7.3
Sensiolabs » Symfony » Version: 2.7.30

cpe:2.3:a:sensiolabs:symfony:2.7.30
Sensiolabs » Symfony » Version: 2.7.31

cpe:2.3:a:sensiolabs:symfony:2.7.31
Sensiolabs » Symfony » Version: 2.7.32

cpe:2.3:a:sensiolabs:symfony:2.7.32
Sensiolabs » Symfony » Version: 2.7.33

cpe:2.3:a:sensiolabs:symfony:2.7.33
Sensiolabs » Symfony » Version: 2.7.34

cpe:2.3:a:sensiolabs:symfony:2.7.34
Sensiolabs » Symfony » Version: 2.7.35

cpe:2.3:a:sensiolabs:symfony:2.7.35
Sensiolabs » Symfony » Version: 2.7.36

cpe:2.3:a:sensiolabs:symfony:2.7.36
Sensiolabs » Symfony » Version: 2.7.37

cpe:2.3:a:sensiolabs:symfony:2.7.37
Sensiolabs » Symfony » Version: 2.7.38

cpe:2.3:a:sensiolabs:symfony:2.7.38
Sensiolabs » Symfony » Version: 2.7.39

cpe:2.3:a:sensiolabs:symfony:2.7.39
Sensiolabs » Symfony » Version: 2.7.4

cpe:2.3:a:sensiolabs:symfony:2.7.4
Sensiolabs » Symfony » Version: 2.7.40

cpe:2.3:a:sensiolabs:symfony:2.7.40
Sensiolabs » Symfony » Version: 2.7.41

cpe:2.3:a:sensiolabs:symfony:2.7.41
Sensiolabs » Symfony » Version: 2.7.42

cpe:2.3:a:sensiolabs:symfony:2.7.42
Sensiolabs » Symfony » Version: 2.7.43

cpe:2.3:a:sensiolabs:symfony:2.7.43
Sensiolabs » Symfony » Version: 2.7.44

cpe:2.3:a:sensiolabs:symfony:2.7.44
Sensiolabs » Symfony » Version: 2.7.45

cpe:2.3:a:sensiolabs:symfony:2.7.45
Sensiolabs » Symfony » Version: 2.7.46

cpe:2.3:a:sensiolabs:symfony:2.7.46
Sensiolabs » Symfony » Version: 2.7.47

cpe:2.3:a:sensiolabs:symfony:2.7.47
Sensiolabs » Symfony » Version: 2.7.5

cpe:2.3:a:sensiolabs:symfony:2.7.5
Sensiolabs » Symfony » Version: 2.7.6

cpe:2.3:a:sensiolabs:symfony:2.7.6
Sensiolabs » Symfony » Version: 2.7.7

cpe:2.3:a:sensiolabs:symfony:2.7.7
Sensiolabs » Symfony » Version: 2.7.8

cpe:2.3:a:sensiolabs:symfony:2.7.8
Sensiolabs » Symfony » Version: 2.7.9

cpe:2.3:a:sensiolabs:symfony:2.7.9
Sensiolabs » Symfony » Version: 2.8.0

cpe:2.3:a:sensiolabs:symfony:2.8.0
Sensiolabs » Symfony » Version: 2.8.1

cpe:2.3:a:sensiolabs:symfony:2.8.1
Sensiolabs » Symfony » Version: 2.8.10

cpe:2.3:a:sensiolabs:symfony:2.8.10
Sensiolabs » Symfony » Version: 2.8.11

cpe:2.3:a:sensiolabs:symfony:2.8.11
Sensiolabs » Symfony » Version: 2.8.12

cpe:2.3:a:sensiolabs:symfony:2.8.12
Sensiolabs » Symfony » Version: 2.8.13

cpe:2.3:a:sensiolabs:symfony:2.8.13
Sensiolabs » Symfony » Version: 2.8.14

cpe:2.3:a:sensiolabs:symfony:2.8.14
Sensiolabs » Symfony » Version: 2.8.15

cpe:2.3:a:sensiolabs:symfony:2.8.15
Sensiolabs » Symfony » Version: 2.8.16

cpe:2.3:a:sensiolabs:symfony:2.8.16
Sensiolabs » Symfony » Version: 2.8.17

cpe:2.3:a:sensiolabs:symfony:2.8.17
Sensiolabs » Symfony » Version: 2.8.18

cpe:2.3:a:sensiolabs:symfony:2.8.18
Sensiolabs » Symfony » Version: 2.8.19

cpe:2.3:a:sensiolabs:symfony:2.8.19
Sensiolabs » Symfony » Version: 2.8.2

cpe:2.3:a:sensiolabs:symfony:2.8.2
Sensiolabs » Symfony » Version: 2.8.20

cpe:2.3:a:sensiolabs:symfony:2.8.20
Sensiolabs » Symfony » Version: 2.8.21

cpe:2.3:a:sensiolabs:symfony:2.8.21
Sensiolabs » Symfony » Version: 2.8.22

cpe:2.3:a:sensiolabs:symfony:2.8.22
Sensiolabs » Symfony » Version: 2.8.23

cpe:2.3:a:sensiolabs:symfony:2.8.23
Sensiolabs » Symfony » Version: 2.8.24

cpe:2.3:a:sensiolabs:symfony:2.8.24
Sensiolabs » Symfony » Version: 2.8.25

cpe:2.3:a:sensiolabs:symfony:2.8.25
Sensiolabs » Symfony » Version: 2.8.26

cpe:2.3:a:sensiolabs:symfony:2.8.26
Sensiolabs » Symfony » Version: 2.8.27

cpe:2.3:a:sensiolabs:symfony:2.8.27
Sensiolabs » Symfony » Version: 2.8.28

cpe:2.3:a:sensiolabs:symfony:2.8.28
Sensiolabs » Symfony » Version: 2.8.29

cpe:2.3:a:sensiolabs:symfony:2.8.29
Sensiolabs » Symfony » Version: 2.8.3

cpe:2.3:a:sensiolabs:symfony:2.8.3
Sensiolabs » Symfony » Version: 2.8.30

cpe:2.3:a:sensiolabs:symfony:2.8.30
Sensiolabs » Symfony » Version: 2.8.31

cpe:2.3:a:sensiolabs:symfony:2.8.31
Sensiolabs » Symfony » Version: 2.8.32

cpe:2.3:a:sensiolabs:symfony:2.8.32
Sensiolabs » Symfony » Version: 2.8.33

cpe:2.3:a:sensiolabs:symfony:2.8.33
Sensiolabs » Symfony » Version: 2.8.34

cpe:2.3:a:sensiolabs:symfony:2.8.34
Sensiolabs » Symfony » Version: 2.8.35

cpe:2.3:a:sensiolabs:symfony:2.8.35
Sensiolabs » Symfony » Version: 2.8.36

cpe:2.3:a:sensiolabs:symfony:2.8.36
Sensiolabs » Symfony » Version: 2.8.37

cpe:2.3:a:sensiolabs:symfony:2.8.37
Sensiolabs » Symfony » Version: 2.8.38

cpe:2.3:a:sensiolabs:symfony:2.8.38
Sensiolabs » Symfony » Version: 2.8.39

cpe:2.3:a:sensiolabs:symfony:2.8.39
Sensiolabs » Symfony » Version: 2.8.4

cpe:2.3:a:sensiolabs:symfony:2.8.4
Sensiolabs » Symfony » Version: 2.8.40

cpe:2.3:a:sensiolabs:symfony:2.8.40
Sensiolabs » Symfony » Version: 2.8.5

cpe:2.3:a:sensiolabs:symfony:2.8.5
Sensiolabs » Symfony » Version: 2.8.6

cpe:2.3:a:sensiolabs:symfony:2.8.6
Sensiolabs » Symfony » Version: 2.8.7

cpe:2.3:a:sensiolabs:symfony:2.8.7
Sensiolabs » Symfony » Version: 2.8.8

cpe:2.3:a:sensiolabs:symfony:2.8.8
Sensiolabs » Symfony » Version: 2.8.9

cpe:2.3:a:sensiolabs:symfony:2.8.9
Sensiolabs » Symfony » Version: 3.3.0

cpe:2.3:a:sensiolabs:symfony:3.3.0
Sensiolabs » Symfony » Version: 3.3.1

cpe:2.3:a:sensiolabs:symfony:3.3.1
Sensiolabs » Symfony » Version: 3.3.10

cpe:2.3:a:sensiolabs:symfony:3.3.10
Sensiolabs » Symfony » Version: 3.3.11

cpe:2.3:a:sensiolabs:symfony:3.3.11
Sensiolabs » Symfony » Version: 3.3.12

cpe:2.3:a:sensiolabs:symfony:3.3.12
Sensiolabs » Symfony » Version: 3.3.13

cpe:2.3:a:sensiolabs:symfony:3.3.13
Sensiolabs » Symfony » Version: 3.3.14

cpe:2.3:a:sensiolabs:symfony:3.3.14
Sensiolabs » Symfony » Version: 3.3.15

cpe:2.3:a:sensiolabs:symfony:3.3.15
Sensiolabs » Symfony » Version: 3.3.16

cpe:2.3:a:sensiolabs:symfony:3.3.16
Sensiolabs » Symfony » Version: 3.3.2

cpe:2.3:a:sensiolabs:symfony:3.3.2
Sensiolabs » Symfony » Version: 3.3.3

cpe:2.3:a:sensiolabs:symfony:3.3.3
Sensiolabs » Symfony » Version: 3.3.4

cpe:2.3:a:sensiolabs:symfony:3.3.4
Sensiolabs » Symfony » Version: 3.3.5

cpe:2.3:a:sensiolabs:symfony:3.3.5
Sensiolabs » Symfony » Version: 3.3.6

cpe:2.3:a:sensiolabs:symfony:3.3.6
Sensiolabs » Symfony » Version: 3.3.7

cpe:2.3:a:sensiolabs:symfony:3.3.7
Sensiolabs » Symfony » Version: 3.3.8

cpe:2.3:a:sensiolabs:symfony:3.3.8
Sensiolabs » Symfony » Version: 3.3.9

cpe:2.3:a:sensiolabs:symfony:3.3.9
Sensiolabs » Symfony » Version: 3.4.0

cpe:2.3:a:sensiolabs:symfony:3.4.0
Sensiolabs » Symfony » Version: 3.4.1

cpe:2.3:a:sensiolabs:symfony:3.4.1
Sensiolabs » Symfony » Version: 3.4.10

cpe:2.3:a:sensiolabs:symfony:3.4.10
Sensiolabs » Symfony » Version: 3.4.2

cpe:2.3:a:sensiolabs:symfony:3.4.2
Sensiolabs » Symfony » Version: 3.4.3

cpe:2.3:a:sensiolabs:symfony:3.4.3
Sensiolabs » Symfony » Version: 3.4.4

cpe:2.3:a:sensiolabs:symfony:3.4.4
Sensiolabs » Symfony » Version: 3.4.5

cpe:2.3:a:sensiolabs:symfony:3.4.5
Sensiolabs » Symfony » Version: 3.4.6

cpe:2.3:a:sensiolabs:symfony:3.4.6
Sensiolabs » Symfony » Version: 3.4.7

cpe:2.3:a:sensiolabs:symfony:3.4.7
Sensiolabs » Symfony » Version: 3.4.8

cpe:2.3:a:sensiolabs:symfony:3.4.8
Sensiolabs » Symfony » Version: 3.4.9

cpe:2.3:a:sensiolabs:symfony:3.4.9
Sensiolabs » Symfony » Version: 4.0.0

cpe:2.3:a:sensiolabs:symfony:4.0.0
Sensiolabs » Symfony » Version: 4.0.1

cpe:2.3:a:sensiolabs:symfony:4.0.1
Sensiolabs » Symfony » Version: 4.0.10

cpe:2.3:a:sensiolabs:symfony:4.0.10
Sensiolabs » Symfony » Version: 4.0.2

cpe:2.3:a:sensiolabs:symfony:4.0.2
Sensiolabs » Symfony » Version: 4.0.3

cpe:2.3:a:sensiolabs:symfony:4.0.3
Sensiolabs » Symfony » Version: 4.0.4

cpe:2.3:a:sensiolabs:symfony:4.0.4
Sensiolabs » Symfony » Version: 4.0.5

cpe:2.3:a:sensiolabs:symfony:4.0.5
Sensiolabs » Symfony » Version: 4.0.6

cpe:2.3:a:sensiolabs:symfony:4.0.6
Sensiolabs » Symfony » Version: 4.0.7

cpe:2.3:a:sensiolabs:symfony:4.0.7
Sensiolabs » Symfony » Version: 4.0.8

cpe:2.3:a:sensiolabs:symfony:4.0.8
Sensiolabs » Symfony » Version: 4.0.9

cpe:2.3:a:sensiolabs:symfony:4.0.9
Debian » Debian Linux » Version: 9.0

cpe:2.3:o:debian:debian_linux:9.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2018-11406

Products

Pricing

Contact Us