CVE-2021-21424: Prevent user enumeration using Guard or the new Authenticator-based Security

Published May 12, 2021
·
Updated

CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms

Other sources

Description -----------

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user.

Resolution ----------

We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist.

The patch for this issue is available here for branch 3.4.

Credits -------

I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.

— GitHub

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.

Affected Software

29 affected componentsFixes available
composer/symfony/symfony>=2.8.0, <3.0.0, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.4.0, >=3.4.0, <3.4.49, >=4.0.0, <4.1.0, >=4.1.0, <4.2.0, >=4.2.0, <4.3.0, >=4.3.0, <4.4.0, >=4.4.0, <4.4.24, >=5.0.0, <5.1.0, >=5.1.0, <5.2.0, >=5.2.0, <5.2.9
composer/lexik/jwt-authentication-bundle>=2.0.0, <2.1.0, >=2.1.0, <2.2.0, >=2.2.0, <2.3.0, >=2.3.0, <2.4.0, >=2.4.0, <2.5.0, >=2.5.0, <2.6.0, >=2.6.0, <2.7.0, >=2.7.0, <2.8.0, >=2.8.0, <2.9.0, >=2.9.0, <2.10.0, >=2.10.0, <2.10.7, >=2.11.0, <2.11.3
composer/symfony/security>=2.8.0, <3.0.0, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.4.0, >=3.4.0, <3.4.49, >=4.0.0, <4.1.0, >=4.1.0, <4.2.0, >=4.2.0, <4.3.0, >=4.3.0, <4.4.0, >=4.4.0, <4.4.24
composer/symfony/security-core>=2.8.0, <3.0.0, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.4.0, >=3.4.0, <3.4.49, >=4.0.0, <4.1.0, >=4.1.0, <4.2.0, >=4.2.0, <4.3.0, >=4.3.0, <4.4.0, >=4.4.0, <4.4.24, >=5.0.0, <5.1.0, >=5.1.0, <5.2.0, >=5.2.0, <5.2.9
composer/symfony/security-guard>=2.8.0, <3.0.0, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.4.0, >=3.4.0, <3.4.48, >=4.0.0, <4.1.0, >=4.1.0, <4.2.0, >=4.2.0, <4.3.0, >=4.3.0, <4.4.0, >=4.4.0, <4.4.23, >=5.0.0, <5.1.0, >=5.1.0, <5.2.0, >=5.2.0, <5.2.8
composer/symfony/maker-bundle>=1.27.0, <1.28.0, >=1.28.0, <1.29.0, >=1.29.0, <1.29.2, >=1.30.0, <1.31.0, >=1.31.0, <1.31.1
composer/symfony/security-http>=5.1.0, <5.2.0, >=5.2.0, <5.2.8
composer/symfony/symfony>=5.0.0<5.2.9
5.2.9
composer/symfony/symfony>=4.0.0<4.4.24
4.4.24
composer/symfony/symfony>=2.8.0<3.4.49
3.4.49
composer/symfony/security>=4.0.0<4.4.24
4.4.24
composer/symfony/security>=2.8.0<3.4.49
3.4.49
composer/symfony/security-http>=5.1.0<5.2.8
5.2.8
composer/symfony/maker-bundle>=1.30.0<1.31.1
1.31.1
composer/symfony/maker-bundle>=1.27.0<1.29.2
1.29.2
composer/lexik/jwt-authentication-bundle>=2.11.0<2.11.3
2.11.3
composer/lexik/jwt-authentication-bundle>=2.0.0<2.10.7
2.10.7
composer/symfony/security-core>=5.0.0<5.2.8
5.2.8
composer/symfony/security-core>=4.0.0<4.4.23
4.4.23
composer/symfony/security-core>=2.8.0<3.4.48
3.4.48
composer/symfony/security-guard>=5.0.0<5.2.8
5.2.8
composer/symfony/security-guard>=4.0.0<4.4.23
4.4.23
composer/symfony/security-guard>=2.8.0<3.4.48
3.4.48
composer/symfony/security>=5.0.0<5.2.8
5.2.8
SensioLabs Symfony>=2.8.0<3.4.48
SensioLabs Symfony>=4.0.0<4.4.23
SensioLabs Symfony>=5.0.0<5.2.8
Fedoraproject Fedora=33
Fedoraproject Fedora=34

Remediation

Patch Available

https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011

Patch Available

https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68

Event History

May 12, 2021
Advisory Published
08:00 AM
May 13, 2021
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2021-21424?

CVE-2021-21424 is a vulnerability in Symfony, a PHP framework for web and console applications, that allows user enumeration via response content in authentication mechanisms.

2

What is the severity of CVE-2021-21424?

The severity of CVE-2021-21424 is medium, with a severity value of 5.3.

3

Which versions of Symfony are affected by CVE-2021-21424?

The versions of Symfony affected by CVE-2021-21424 are between 2.8.0 and 3.4.48, between 4.0.0 and 4.4.23, and between 5.0.0 and 5.2.8.

4

How can I fix CVE-2021-21424?

To fix CVE-2021-21424, upgrade Symfony to a version that is not affected, such as 3.4.49, 4.4.24, or 5.2.9.

5

Where can I find more information about CVE-2021-21424?

You can find more information about CVE-2021-21424 on the Symfony website and the GitHub pages for the Symfony project and security advisories.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203