Detections
Analytics
SCA: security update for symfony/security-bundle, symfony/symfony (GHSA-qw36-p97w-vcqr)
high Tenable Self-Hosted Container Security Plugin ID 418352
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console
applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version
5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefore
maintain their access to the account even if the password is changed as long as they have had the chance
to login once and get a valid remember me cookie. Starting with version 5.3.12, Symfony makes the password
part of the signature by default. In that way, when the password changes, then the cookie is not valid
anymore. (CVE-2021-41268)
See Also
Plugin Details
Severity: High
ID: 418352
Version: Revision 1.8
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 4.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2021-41268
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 11/24/2021
Vulnerability Publication Date: 11/24/2021
Reference Information
CVE: CVE-2021-41268
cwe: CWE-384