CVE-2024-51996

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287 CWE-289

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-519978.1Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Tok CVE-2024-519988.6changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in CVE-2024-52004.8The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-520006.1Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) expl CVE-2024-520014.3Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services info CVE-2024-520028.8Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vul CVE-2024-520036.1Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provi CVE-2024-520048.7MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnera CVE-2024-520058.8Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported CVE-2024-520067.5Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and CVE-2024-520078.6HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various c CVE-2024-520088.8Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement,