CVE-2023-46733

Summary

CVE-2023-46733 is a vulnerability affecting the Symfony PHP framework, specifically versions 5.4.21 and 6.2.7 and earlier than 5.4.31 and 6.3.8. The issue lies within the `SessionStrategyListener`, which fails to regenerate sessions after every successful login. Instead, it only does so when the user identifier changes. However, in certain scenarios, the user identifier remains unchanged while the token type shifts from partially-authenticated to fully-authenticated. This vulnerability can lead to session fixation attacks, as the session ID should be regenerated to prevent such attacks. Symfony now addresses this issue by checking the token type, in addition to the user identifier, before deciding to regenerate the session ID.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.