CVE-2018-11386

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-11398.1A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disab CVE-2018-113928.8An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.1.1, as distributed CVE-2018-113967.5ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (applicat CVE-2018-113994.3SimpliSafe Original has Unencrypted Sensor Transmissions, which allows physically proximate attackers to obtain potentially sensitive inform CVE-2018-11406.5A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw CVE-2018-114004.6In SimpliSafe Original, the Base Station fails to detect tamper attempts: it does not send a notification if a physically proximate attacker CVE-2018-114014.6In SimpliSafe Original, RF Interference (e.g., an extremely strong 433.92 MHz signal) by a physically proximate attacker does not cause a no CVE-2018-114026.6SimpliSafe Original has Unencrypted Keypad Transmissions, which allows physically proximate attackers to discover the PIN.CVE-2018-114035.4DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.CVE-2018-114046.1DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.CVE-2018-114058.8Kliqqi 2.0.2 has CSRF in admin/admin_users.php.CVE-2018-114068.8An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4