Withdrawn Advisory: Symfony http-security has authentication bypass

CAO 7.5CVE-2024-36611 · GHSA-7q22-x757-cmgc · Công bố 29/11/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-36611 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng symfony/security-http.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.79%, cao hơn 56.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 7.1.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
symfony/security-http Packagist	`< 7.1.0`	`7.1.0`

Mô tả

Withdrawn Advisory

This advisory has been withdrawn because the report is not part of a valid vulnerability. This link is maintained to preserve external references. For more information, see advisory-database/pull/5046.

Original Description

In Symfony, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service.

Mô tả của NVD

In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.