CVE-2022-24895

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 4.4

Description The issue is related to incorrect session management in Symfony, a PHP framework for web and console applications. When authenticating users, Symfony by default regenerates the session ID upon login but preserves the rest of session attributes, including CSRF tokens. This might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.

Recommendations For versions prior to 4.4, update to version 4.4 or later, which includes the fix for this issue. As a temporary workaround, consider manually clearing CSRF tokens from the session on successful login to prevent potential exploitation.