laravel/framework-v9.47.0: 1 vulnerabilities (highest severity is: 8.8)

[mend-bolt-for-github]

Vulnerable Library - laravel/framework-v9.47.0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (laravel/framework-v9.47.0 version)	Remediation Possible**
CVE-2022-24894	High	8.8	symfony/http-kernel-v6.2.4	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24894

Vulnerable Library - symfony/http-kernel-v6.2.4

Provides a structured process for converting a Request into a Response

Library home page: https://api.github.com/repos/symfony/http-kernel/zipball/74f2e638ec3fa0315443bd85fab7fc8066b77f83

Dependency Hierarchy:

• laravel/framework-v9.47.0 (Root Library)
  • ❌ symfony/http-kernel-v6.2.4 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the AbstractSessionListener, the response might contain a Set-Cookie header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4.

Publish Date: 2023-02-03

URL: CVE-2022-24894

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://symfony.com/blog/cve-2022-24894-prevent-storing-cookie-headers-in-httpcache

Release Date: 2022-02-11

Fix Resolution: v4.4.50, v5.4.20, v6.0.20, v6.1.12, v6.2.6

Step up your Open Source Security Game with Mend here