VulnerableCode Package Details - pkg:composer/symfony/security-bundle@2.5.0-BETA2

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:composer/symfony/security-bundle@2.5.0-BETA2

Essentials
History (2)

purl	pkg:composer/symfony/security-bundle@2.5.0-BETA2

Next non-vulnerable version	4.4.50
Latest non-vulnerable version	6.1.12
Risk

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-7cdk-bmdh-2fde Aliases: CVE-2018-11406 GHSA-g4g7-q726-v5hg	Cross-Site Request Forgery (CSRF) By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the `invalidate_session` option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.	2.7.48 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 2.8.41 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 3.3.17 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.4.11 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 4.0.11 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-uvpz-6mss-9bgn Aliases: CVE-2022-24895 GHSA-3gv2-29qc-v67m GMS-2023-210 GMS-2023-211	Duplicate This advisory duplicates another.	4.4.50 Affected by 0 other vulnerabilities. 5.4.20 Affected by 0 other vulnerabilities. 6.0.20 Affected by 0 other vulnerabilities. 6.1.12 Affected by 0 other vulnerabilities. 6.2.6 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-7cdk-bmdh-2fde
Aliases:
CVE-2018-11406
GHSA-g4g7-q726-v5hg

Cross-Site Request Forgery (CSRF) By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the `invalidate_session` option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.

2.7.48
Affected by 2 other vulnerabilities.

2.8.41
Affected by 1 other vulnerability.

3.3.17
Affected by 3 other vulnerabilities.

3.4.11
Affected by 1 other vulnerability.

4.0.11
Affected by 1 other vulnerability.

VCID-uvpz-6mss-9bgn
Aliases:
CVE-2022-24895
GHSA-3gv2-29qc-v67m
GMS-2023-210
GMS-2023-211

Duplicate This advisory duplicates another.

4.4.50
Affected by 0 other vulnerabilities.

5.4.20
Affected by 0 other vulnerabilities.

6.0.20
Affected by 0 other vulnerabilities.

6.1.12
Affected by 0 other vulnerabilities.

6.2.6
Affected by 1 other vulnerability.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-01T07:16:45.060551+00:00	GitLab Importer	Affected by	VCID-uvpz-6mss-9bgn	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/security-bundle/GMS-2023-210.yml	38.6.0
2026-05-31T09:47:18.245302+00:00	GitLab Importer	Affected by	VCID-7cdk-bmdh-2fde	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/security-bundle/CVE-2018-11406.yml	38.6.0