CVE-2024-50341

Summary

CVE-2024-50341 is a vulnerability affecting the symfony/security-bundle module in versions 6.4.10, 7.0.10, and 7.1.3 of the Symfony PHP framework. This module is responsible for integrating the Security component into Symfony. The issue lies in the fact that the custom `user_checker` defined on a firewall is not invoked when using the `Security::login` method for programmatic logins. This vulnerability allows unauthorized access, making it crucial for all users to upgrade to the latest versions, where the `Security::login` method now ensures the `user_checker` is called. No known workarounds exist for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.