CVE - CVE-2021-32693

CVE-ID
CVE-2021-32693	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the application, in such a situation, a user authenticated on a part of the application could be considered authenticated on the rest of the application. Starting in version 5.3.2, a patch ensures that the authenticated token is only available for the firewall that generates it.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrq URL:https://github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrq MISC:https://github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129 URL:https://github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129 MISC:https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728 URL:https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728 MISC:https://symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-one URL:https://symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-one
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20210512	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210512)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)