FKIE_CVE-2024-36611

Vulnerability from fkie_nvd - Published: 2024-11-29 19:15 - Updated: 2026-06-17 07:37
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.
References
cve@mitre.orghttps://gist.github.com/1047524396/3581425e0911b716cf8ce4fa30e41e6c
cve@mitre.orghttps://github.com/github/advisory-database/pull/5046
cve@mitre.orghttps://github.com/symfony/symfony/blob/v7.0.7/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php#L132
cve@mitre.orghttps://github.com/symfony/symfony/commit/a804ca15fcad279d7727b91d12a667fd5b925995
cve@mitre.orghttps://github.com/symfony/symfony/issues/59077#issuecomment-2513935018
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:symfony:symfony:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "symfony",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "7.07"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [
    {
      "sourceIdentifier": "cve@mitre.org",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report."
    },
    {
      "lang": "es",
      "value": "En Symfony v7.07, se identific\u00f3 una vulnerabilidad de seguridad en el componente FormLoginAuthenticator, que no pod\u00eda gestionar adecuadamente los casos en los que el campo de nombre de usuario o contrase\u00f1a de una solicitud de inicio de sesi\u00f3n estaba vac\u00edo. Este fallo podr\u00eda generar varios riesgos de seguridad, incluido el manejo inadecuado de la l\u00f3gica de autenticaci\u00f3n o la denegaci\u00f3n de servicio."
    }
  ],
  "id": "CVE-2024-36611",
  "lastModified": "2026-06-17T07:37:01.310",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-36611",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-12-03T15:19:25.381038Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-11-29T19:15:06.780",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://gist.github.com/1047524396/3581425e0911b716cf8ce4fa30e41e6c"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/github/advisory-database/pull/5046"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/symfony/symfony/blob/v7.0.7/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php#L132"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/symfony/symfony/commit/a804ca15fcad279d7727b91d12a667fd5b925995"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/symfony/symfony/issues/59077#issuecomment-2513935018"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.