CVE-2018-11386
At a glance
- Source
- NVD
- EPSS
- EPSS 1.58 % · percentile 75 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
Weaknesses (CWE)
- CWE-613 — DEPRECATED: Insufficient Session Expiration
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/
- https://symfony.com/blog/cve-2018-11386-denial-of-service-when-using-pdosessionhandler
- https://www.debian.org/security/2018/dsa-4262
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-r2rq-3h56-fqm4 — Symfony DoS
European references
- ENISA EUVD · EUVD-2022-5068
- GCVE · GCVE-0-2018-11386
Affected configurations (NVD CPE)
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 2.7.0 < 2.7.48cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 2.8.0 < 2.8.41cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 3.3.0 < 3.3.17cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.11cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.11cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |