CVE-2022-24894: Symfony storing cookie headers in HttpCache

Published Feb 1, 2023
·
Updated

CVE-2022-24894: Prevent storing cookie headers in HttpCache

Other sources

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the AbstractSessionListener, the response might contain a Set-Cookie header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4.

— Launchpad

Affected Software

8 affected componentsFixes available
composer/symfony/symfony>=2.0.0, <2.1.0, >=2.1.0, <2.2.0, >=2.2.0, <2.3.0, >=2.3.0, <2.4.0, >=2.4.0, <2.5.0, >=2.5.0, <2.6.0, >=2.6.0, <2.7.0, >=2.7.0, <2.8.0, >=2.8.0, <3.0.0, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.4.0, >=3.4.0, <4.0.0, >=4.0.0, <4.1.0, >=4.1.0, <4.2.0, >=4.2.0, <4.3.0, >=4.3.0, <4.4.0, >=4.4.0, <4.4.50, >=5.0.0, <5.1.0, >=5.1.0, <5.2.0, >=5.2.0, <5.3.0, >=5.3.0, <5.4.0, >=5.4.0, <5.4.20, >=6.0.0, <6.0.20, >=6.1.0, <6.1.12, >=6.2.0, <6.2.6
composer/symfony/http-kernel>=2.0.0, <2.1.0, >=2.1.0, <2.2.0, >=2.2.0, <2.3.0, >=2.3.0, <2.4.0, >=2.4.0, <2.5.0, >=2.5.0, <2.6.0, >=2.6.0, <2.7.0, >=2.7.0, <2.8.0, >=2.8.0, <3.0.0, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.4.0, >=3.4.0, <4.0.0, >=4.0.0, <4.1.0, >=4.1.0, <4.2.0, >=4.2.0, <4.3.0, >=4.3.0, <4.4.0, >=4.4.0, <4.4.50, >=5.0.0, <5.1.0, >=5.1.0, <5.2.0, >=5.2.0, <5.3.0, >=5.3.0, <5.4.0, >=5.4.0, <5.4.20, >=6.0.0, <6.0.20, >=6.1.0, <6.1.12, >=6.2.0, <6.2.6
debian/symfony
4.4.19+dfsg-2+deb11u65.4.23+dfsg-1+deb12u46.4.18+dfsg-1
SensioLabs Symfony>=2.0.0<4.4.50
SensioLabs Symfony>=5.0.0<5.4.2
SensioLabs Symfony>=6.0.0<6.0.20
SensioLabs Symfony>=6.1.0<6.1.12
SensioLabs Symfony>=6.2.0<6.2.6

Remediation

Patch Available

https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb

Event History

Feb 1, 2023
Advisory Published
08:00 AM
Feb 3, 2023
CVE Published
via MITRE·09:46 PM
Data Sourced
via MITRE·09:46 PM
DescriptionSeverityWeakness
Feb 18, 2025
Data Sourced
via Ubuntu·08:23 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·08:23 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2022-24894?

CVE-2022-24894 is a vulnerability in the Symfony PHP framework that allows cookie headers to be stored in the HttpCache.

2

What is the severity of CVE-2022-24894?

The severity of CVE-2022-24894 is high with a CVSS score of 8.8.

3

How does CVE-2022-24894 affect Symfony?

CVE-2022-24894 affects Symfony versions from 2.0.0 to 4.4.50, 5.0.0 to 5.4.2, 6.0.0 to 6.0.20, 6.1.0 to 6.1.12, and 6.2.0 to 6.2.6.

4

How can I fix CVE-2022-24894 in Symfony?

To fix CVE-2022-24894 in Symfony, upgrade to a version that is not affected by the vulnerability.

5

Where can I find more information about CVE-2022-24894?

You can find more information about CVE-2022-24894 on the Symfony website and the GitHub security advisories.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203