{"action":"Upgrade symfony/security-bundle to 4.4.50 or later.","affected":[{"fixed":"4.4.50","introduced":"2.0.0"},{"fixed":"5.4.20","introduced":"5.0.0"},{"fixed":"6.0.20","introduced":"6.0.0"},{"fixed":"6.1.12","introduced":"6.1.0"},{"fixed":"6.2.6","introduced":"6.2.0"}],"component":"symfony/security-bundle","cve_ids":["CVE-2022-24895"],"ecosystem":"Packagist","epss":0.0079,"exploited":false,"fixed_versions":["4.4.50","5.4.20","6.0.20","6.1.12","6.2.6"],"ghsa_id":"GHSA-3gv2-29qc-v67m","id":"tcs_01M5KESZSHB5GRY3MB4JPE8WSB","modified_at":"2025-02-13T18:50:25.319043Z","published_at":"2023-02-01T18:48:06Z","references":["https://osv.dev/vulnerability/GHSA-3gv2-29qc-v67m","https://github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67m","https://nvd.nist.gov/vuln/detail/CVE-2022-24895","https://github.com/symfony/security-bundle/commit/076fd2088ada33d760758d98ff07ddedbf567946","https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2022-24895.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2022-24895.yaml","https://github.com/symfony/symfony","https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html","https://symfony.com/cve-2022-24895"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-3gv2-29qc-v67m","url":"https://osv.dev/vulnerability/GHSA-3gv2-29qc-v67m"}],"summary":"Symfony vulnerable to Session Fixation of CSRF tokens"}