github_osv/GHSA-92x6-h2gr-8gxq
Symfony CSRF Vulnerability
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.
gitlab/packagist/symfony/security-csrf/CVE-2017-16653
CSRF vulnerability
The implementation of CSRF protection did not use different tokens for HTTP and HTTPS, therefore the token was subject to MITM attacks on HTTP and could then be used in HTTPS context to do CSRF attacks.
gitlab/packagist/symfony/security/CVE-2017-16653
Channel Accessible by Non-Endpoint (Man-in-the-Middle)
The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.
gitlab/packagist/symfony/symfony/CVE-2017-16653
Cross-Site Request Forgery (CSRF)
The current implementation of CSRF protection in Symfony does not use different tokens for HTTP and HTTPS.