CVE-2019-10911
HIGH
7.5
CVSS Score
Published: May 16, 2019 at 09:29 PM UTC
Updated: June 17, 2026 at 02:11 AM UTC
2 products affected across 2 vendorsDrupalSymfony
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 1%
Description
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
8.5.0 ≤ v < 8.5.158.6.0 ≤ v < 8.6.15
Affected range stops below 8.5.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.6.15, so it looks safe — our inference, not a vendor statement
Symfony· Sensiolabsdrupal
95%2.7.0 ≤ v < 2.7.512.8.0 ≤ v < 2.8.503.4.0 ≤ v < 3.4.264.1.0 ≤ v < 4.1.124.2.0 ≤ v < 4.2.7
Affected range stops below 2.7.51, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.8.50, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.4.26, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.1.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.2.7, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (3)
x_refsource_CONFIRMPatchThird Party Advisory
Source: [email protected]
https://github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hashx_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://www.synology.com/security/advisory/Synology_SA_19_19CVSS
- Attack Vector
- NETWORK
- Complexity
- HIGH
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-287
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card