CVE-2018-11385
Symfony Session Fixation Vulnerability
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
- Record
CVE-2018-11385- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-384
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
- Record
CVE-2018-11385- Updated
- 2026-11-02
EUVDEUVD-2022-3887 No score
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
- Record
EUVD-2022-3887- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g4rg-rw65-8hfg
Symfony Session Fixation Vulnerability
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
- Record
GHSA-g4rg-rw65-8hfg- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
OSV
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
- Record
CVE-2018-11385- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11385
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
- Record
DEBIAN-CVE-2018-11385- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-g4rg-rw65-8hfg
Symfony Session Fixation Vulnerability
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
- Record
GHSA-g4rg-rw65-8hfg- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11385
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
- Record
UBUNTU-CVE-2018-11385- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/symfonyPackagist |
2.7.0 up to 2.7.48 | 2.7.48 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.41 | 2.8.41 |
symfony/symfonyPackagist |
3.4.0 up to 3.4.11 | 3.4.11 |
symfony/symfonyPackagist |
4.0.0 up to 4.0.11 | 4.0.11 |
symfony/symfonyPackagist |
3.0.0 up to 3.3.17 | 3.3.17 |
symfony/security-httpPackagist |
2.7.0 up to 2.7.48 | 2.7.48 |
symfony/security-httpPackagist |
2.8.0 up to 2.8.41 | 2.8.41 |
symfony/security-httpPackagist |
3.0.0 up to 3.3.17 | 3.3.17 |
symfony/security-httpPackagist |
3.4.0 up to 3.4.11 | 3.4.11 |
symfony/security-httpPackagist |
4.0.0 up to 4.0.11 | 4.0.11 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfony/securityPackagist |
2.7.0 up to 2.7.48 | 2.7.48 |
symfony/securityPackagist |
2.8.0 up to 2.8.41 | 2.8.41 |
symfony/securityPackagist |
3.0.0 up to 3.3.17 | 3.3.17 |
symfony/securityPackagist |
3.4.0 up to 3.4.11 | 3.4.11 |
symfony/securityPackagist |
4.0.0 up to 4.0.11 | 4.0.11 |
symfonyDebian:12 |
before 3.4.12+dfsg-1 | 3.4.12+dfsg-1 |
symfonyDebian:13 |
before 3.4.12+dfsg-1 | 3.4.12+dfsg-1 |
symfonyDebian:14 |
before 3.4.12+dfsg-1 | 3.4.12+dfsg-1 |
symfonyDebian:8 From an advisory covering 7 CVEs |
before 2.3.21+dfsg-4+deb8u4, plus listed versions 2.3.21+dfsg-42.3.21+dfsg-4+deb8u12.3.21+dfsg-4+deb8u22.3.21+dfsg-4+deb8u3 |
2.3.21+dfsg-4+deb8u4 |
symfonyDebian:9 From an advisory covering 8 CVEs |
before 2.8.7+dfsg-1.3+deb9u1, plus listed versions 2.8.7+dfsg-1.3 |
2.8.7+dfsg-1.3+deb9u1 |
symfony/symfonyPackagist |
2.7.0 up to 2.7.48, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 43 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.48 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.41, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 36 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.41 |
symfony/symfonyPackagist |
3.0.0 up to 3.3.17, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.3.17 |
symfony/symfonyPackagist |
3.4.0 up to 3.4.11, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3 Show 6 moreShow lessv3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.11 |
symfony/symfonyPackagist |
4.0.0 up to 4.0.11, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3 Show 6 moreShow lessv4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.11 |
symfony/security-httpPackagist |
2.7.0 up to 2.7.48, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 43 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.48 |
symfony/security-httpPackagist |
2.8.0 up to 2.8.41, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 36 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.41 |
symfony/security-httpPackagist |
3.0.0 up to 3.3.17, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.3.17 |
symfony/security-httpPackagist |
3.4.0 up to 3.4.11, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3 Show 6 moreShow lessv3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.11 |
symfony/security-httpPackagist |
4.0.0 up to 4.0.11, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3 Show 6 moreShow lessv4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.11 |
symfony/securityPackagist |
2.7.0 up to 2.7.48, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 43 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.48 |
symfony/securityPackagist |
2.8.0 up to 2.8.41, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 36 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.41 |
symfony/securityPackagist |
3.0.0 up to 3.3.17, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.3.17 |
symfony/securityPackagist |
3.4.0 up to 3.4.11, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3 Show 6 moreShow lessv3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.11 |
symfony/securityPackagist |
4.0.0 up to 4.0.11, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3 Show 6 moreShow lessv4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.11 |
symfonyUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2 |
None known |
symfonyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11385 is a high vulnerability (CVSS 8.1) in Sensiolabs Symfony, published June 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.97%, the 80th percentile. Fixed in symfony/symfony 2.7.48.
References
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authentication
lists.debian.org/debian-lts-announce/2019/03/msg00009.html
debian.org/security/2018/dsa-4262
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-11385
github.com/symfony/symfony/commit/194caff28b56707ea98e746c6582c06acbb9bc3f
security-tracker.debian.org/tracker/CVE-2018-11385
ubuntu.com/security/CVE-2018-11385
cve.org/CVERecord?id=CVE-2018-11385
Left out here: 30 versions. The JSON record has them.