{"action":"Upgrade symfony/security-http to 2.7.51 or later.","affected":[{"fixed":"2.7.51","introduced":"2.7.0"},{"fixed":"2.8.50","introduced":"2.8.0"},{"fixed":"3.4.26","introduced":"3.0.0"},{"fixed":"4.1.12","introduced":"4.0.0"},{"fixed":"4.2.7","introduced":"4.2.0"}],"component":"symfony/security-http","cve_ids":["CVE-2019-10911"],"ecosystem":"Packagist","epss":0.01215,"exploited":false,"fixed_versions":["2.7.51","2.8.50","3.4.26","4.1.12","4.2.7"],"ghsa_id":"GHSA-cchx-mfrc-fwqr","id":"tcs_01M5KF0WXNH3WVTSAK5MB6TB3F","modified_at":"2024-02-16T08:07:16.124191Z","published_at":"2020-02-12T18:45:08Z","references":["https://osv.dev/vulnerability/GHSA-cchx-mfrc-fwqr","https://nvd.nist.gov/vuln/detail/CVE-2019-10911","https://github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-10911.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2019-10911.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10911.yaml","https://github.com/symfony/symfony","https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash","https://symfony.com/cve-2019-10911","https://www.synology.com/security/advisory/Synology_SA_19_19"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cchx-mfrc-fwqr","url":"https://osv.dev/vulnerability/GHSA-cchx-mfrc-fwqr"}],"summary":"Improper authentication in Symfony"}