CVE-2018-11406
Symfony CSRF Token Fixation
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
- Record
CVE-2018-11406- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
- Record
CVE-2018-11406- Updated
- 2026-11-02
EUVDEUVD-2022-3882 No score
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
- Record
EUVD-2022-3882- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g4g7-q726-v5hg
Symfony CSRF Token Fixation
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
- Record
GHSA-g4g7-q726-v5hg- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
- Record
CVE-2018-11406- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11406
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
- Record
DEBIAN-CVE-2018-11406- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-g4g7-q726-v5hg
Symfony CSRF Token Fixation
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
- Record
GHSA-g4g7-q726-v5hg- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11406
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
- Record
UBUNTU-CVE-2018-11406- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/symfonyPackagist |
2.7.0 up to 2.7.48 | 2.7.48 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.41 | 2.8.41 |
symfony/symfonyPackagist |
3.4.0 up to 3.4.11 | 3.4.11 |
symfony/symfonyPackagist |
4.0.0 up to 4.0.11 | 4.0.11 |
symfony/symfonyPackagist |
3.0.0 up to 3.3.17 | 3.3.17 |
symfony/security-bundlePackagist |
2.7.0 up to 2.7.48 | 2.7.48 |
symfony/security-bundlePackagist |
2.8.0 up to 2.8.41 | 2.8.41 |
symfony/security-bundlePackagist |
3.0.0 up to 3.3.17 | 3.3.17 |
symfony/security-bundlePackagist |
3.4.0 up to 3.4.11 | 3.4.11 |
symfony/security-bundlePackagist |
4.0.0 up to 4.0.11 | 4.0.11 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfony/security-httpPackagist |
2.7.0 up to 2.7.48 | 2.7.48 |
symfony/security-httpPackagist |
2.8.0 up to 2.8.41 | 2.8.41 |
symfony/security-httpPackagist |
3.0.0 up to 3.3.17 | 3.3.17 |
symfony/security-httpPackagist |
3.4.0 up to 3.4.11 | 3.4.11 |
symfony/security-httpPackagist |
4.0.0 up to 4.0.11 | 4.0.11 |
symfony/securityPackagist |
2.7.0 up to 2.7.48 | 2.7.48 |
symfony/securityPackagist |
2.8.0 up to 2.8.41 | 2.8.41 |
symfony/securityPackagist |
3.0.0 up to 3.3.17 | 3.3.17 |
symfony/securityPackagist |
3.4.0 up to 3.4.11 | 3.4.11 |
symfony/securityPackagist |
4.0.0 up to 4.0.11 | 4.0.11 |
symfonyDebian:12 |
before 3.4.12+dfsg-1 | 3.4.12+dfsg-1 |
symfonyDebian:13 |
before 3.4.12+dfsg-1 | 3.4.12+dfsg-1 |
symfonyDebian:14 |
before 3.4.12+dfsg-1 | 3.4.12+dfsg-1 |
symfonyDebian:9 From an advisory covering 8 CVEs |
before 2.8.7+dfsg-1.3+deb9u1, plus listed versions 2.8.7+dfsg-1.3 |
2.8.7+dfsg-1.3+deb9u1 |
symfony/symfonyPackagist |
2.7.0 up to 2.7.48, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 43 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.48 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.41, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 36 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.41 |
symfony/symfonyPackagist |
3.0.0 up to 3.3.17, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.3.17 |
symfony/symfonyPackagist |
3.4.0 up to 3.4.11, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3 Show 6 moreShow lessv3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.11 |
symfony/symfonyPackagist |
4.0.0 up to 4.0.11, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3 Show 6 moreShow lessv4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.11 |
symfony/security-bundlePackagist |
2.7.0 up to 2.7.48, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 43 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.48 |
symfony/security-bundlePackagist |
2.8.0 up to 2.8.41, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 36 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.41 |
symfony/security-bundlePackagist |
3.0.0 up to 3.3.17, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.3.17 |
symfony/security-bundlePackagist |
3.4.0 up to 3.4.11, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3 Show 6 moreShow lessv3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.11 |
symfony/security-bundlePackagist |
4.0.0 up to 4.0.11, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3 Show 6 moreShow lessv4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.11 |
symfony/security-httpPackagist |
2.7.0 up to 2.7.48, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 43 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.48 |
symfony/security-httpPackagist |
2.8.0 up to 2.8.41, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 36 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.41 |
symfony/security-httpPackagist |
3.0.0 up to 3.3.17, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.3.17 |
symfony/security-httpPackagist |
3.4.0 up to 3.4.11, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3 Show 6 moreShow lessv3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.11 |
symfony/security-httpPackagist |
4.0.0 up to 4.0.11, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3 Show 6 moreShow lessv4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.11 |
symfony/securityPackagist |
2.7.0 up to 2.7.48, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 43 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.48 |
symfony/securityPackagist |
2.8.0 up to 2.8.41, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 36 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.41 |
symfony/securityPackagist |
3.0.0 up to 3.3.17, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.3.17 |
symfony/securityPackagist |
3.4.0 up to 3.4.11, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.2v3.4.3 Show 6 moreShow lessv3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.11 |
symfony/securityPackagist |
4.0.0 up to 4.0.11, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.2v4.0.3 Show 6 moreShow lessv4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.11 |
symfonyUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2 |
None known |
symfonyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11406 is a high vulnerability (CVSS 8.8) in Sensiolabs Symfony, published June 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in symfony/symfony 2.7.48.
References
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
symfony.com/blog/cve-2018-11406-csrf-token-fixation
debian.org/security/2018/dsa-4262
nvd.nist.gov/vuln/detail/CVE-2018-11406
Show 14 moreShow less
github.com/symfony/symfony/commit/319e1bdd43979d9c1559497de8d69adea28ab8d1
security-tracker.debian.org/tracker/CVE-2018-11406
ubuntu.com/security/CVE-2018-11406
cve.org/CVERecord?id=CVE-2018-11406
Left out here: 40 versions. The JSON record has them.