Vulnerability Report

CVE-2022-23601

Title: CSRF vulnerability in Symfony Form component

CSRF

Proof Of Concept

No public PoC currently indexed for CVE-2022-23601.

CWE Category CWE-352
Published Date Feb 01, 2022
Modified Date Nov 21, 2024
Exploit Status Not Found
Score 8.1 CVSS v3.1
Exploit Probability (EPSS)
0.57%

Vulnerability Summary

CVE-2022-23601: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled. In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks. This issue has been resolved in the patch versions listed and users are advised to update. There are no known workarounds for this issue.

Impacted Vendors

A
auth0 1
S
sensiolabs 1

Reference Links

https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50 https://github.com/symfony/symfony/security/advisories/GHSA-vvmr-8829-6whx https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50 https://github.com/symfony/symfony/security/advisories/GHSA-vvmr-8829-6whx
CVSS v3.1
Source Entity [email protected]
Severity HIGH
8.1
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v3.1
Source Entity [email protected]
Severity HIGH
8.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
6.8
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:M/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2022-23601 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction REQUIRED
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected Stack

No specific products linked.