{"action":"Upgrade symfony/security-http to 2.6.12 or later.","affected":[{"fixed":"2.6.12","introduced":"2.4.0"},{"fixed":"2.7.7","introduced":"2.7.0"}],"component":"symfony/security-http","cve_ids":["CVE-2015-8124"],"ecosystem":"Packagist","epss":0.02712,"exploited":false,"fixed_versions":["2.6.12","2.7.7"],"ghsa_id":"GHSA-j5jh-hpr4-h332","id":"tcs_01M5KF4893XTR034QB0E19MK2P","modified_at":"2024-02-16T08:09:28.922004Z","published_at":"2022-05-14T02:47:28Z","references":["https://osv.dev/vulnerability/GHSA-j5jh-hpr4-h332","https://nvd.nist.gov/vuln/detail/CVE-2015-8124","https://github.com/symfony/symfony/pull/16631","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8124.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8124.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8124.yaml","https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature","https://symfony.com/cve-2015-8124","https://web.archive.org/web/20201209020014/http://www.securityfocus.com/archive/1/537183/100/0/threaded","https://web.archive.org/web/20210125123853/http://www.securityfocus.com/bid/77694","http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html","http://seclists.org/fulldisclosure/2015/Dec/89","http://www.debian.org/security/2015/dsa-3402"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"GHSA-j5jh-hpr4-h332#Packagist/symfony/security-http","url":"https://osv.dev/vulnerability/GHSA-j5jh-hpr4-h332"}],"summary":"Symfony Session Fixation Vulnerability"}