High
Security advisory
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-11406
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:33 UTC · Revision 1
Source evidence
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
osv:CVE-2018-11406
Complete source record
{
"id": "37f02d53285ffa302d46b33e7cbd58868b369248f73b8c3e7d96779d2487f6ed",
"url": "https://osv.dev/vulnerability/CVE-2018-11406",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-11406",
"summary": "An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.",
"evidence": "osv:CVE-2018-11406",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2018-11406",
"aliases": [
"CVE-2018-11406",
"GHSA-g4g7-q726-v5hg"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/symfony/security-http",
"type": "GIT",
"events": [
{
"introduced": "de2f3d51160791ef254010953dbde178fee9845f"
},
{
"fixed": "682c866cd03064d74c884ba67ff0db212dba5575"
},
{
"introduced": "a8d5dd00894f8b5e3edb897f4504c51ddc442370"
},
{
"fixed": "2c846c6c79093fce67a424c779de7c12bc8f8870"
},
{
"introduced": "760872233cd3147870184697e3481ffa492ac2fb"
},
{
"fixed": "7cb076f64ed0310504caaad1180a211be949c5db"
},
{
"introduced": "33c98765dc6fec4907b7431d10e3c0945f061108"
},
{
"fixed": "f5d8fff7eb3ffa21764788d5eed9f0b6d825ab3e"
},
{
"introduced": "afa69c531f22fb4b9fc95017ec0e5d6c77db0c3c"
},
{
"fixed": "1761ec249d4af3d5aa8e831c70fd7c0fd23c88f7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.48"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.41"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.17"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4.0"
},
{
"fixed": "3.4.11"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.11"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v4.0.10",
"v3.4.10",
"v3.3.16",
"v2.8.40",
"v2.7.47",
"v3.4.9",
"v3.4.8",
"v3.4.7",
"v3.4.6",
"v3.4.5",
"v2.8.39",
"v2.8.38",
"v2.8.37",
"v2.8.36",
"v2.8.35",
"v2.7.46",
"v2.7.45",
"v2.7.44",
"v2.7.43",
"v2.7.42",
"v4.0.9",
"v4.0.8",
"v4.0.7",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v3.4.4",
"v2.7.41",
"v2.8.34",
"v2.7.39",
"v2.7.38",
"v4.0.3",
"v3.4.3",
"v3.3.15",
"v2.8.33",
"v2.7.40",
"v4.0.2",
"v4.0.1",
"v4.0.0-RC2",
"v4.0.0",
"v3.4.2",
"v3.4.1",
"v3.4.0-RC2",
"v3.4.0-RC1",
"v3.4.0",
"v3.3.14",
"v3.3.13",
"v2.8.32",
"v2.8.31",
"v3.3.12",
"v3.3.11",
"v2.8.30",
"v2.8.29",
"v2.7.37",
"v2.7.36",
"v3.3.10",
"v2.8.28",
"v2.7.35",
"v2.7.34",
"v3.3.9",
"v3.3.8",
"v3.3.7",
"v2.8.27",
"v2.8.26",
"v2.7.33",
"v3.3.6",
"v3.3.5",
"v3.3.4",
"v3.3.3",
"v2.8.25",
"v2.8.24",
"v2.8.23",
"v2.7.32",
"v2.7.31",
"v2.7.30",
"v3.3.2",
"v3.3.1",
"v3.3.0",
"v2.8.22",
"v2.7.29",
"v2.8.21",
"v2.7.28",
"v2.8.20",
"v2.7.27",
"v2.8.19",
"v2.7.26",
"v2.8.18",
"v2.7.25",
"v2.8.17",
"v2.8.16",
"v2.7.24",
"v2.7.23",
"v2.8.15",
"v2.7.22",
"v2.8.14",
"v2.8.13",
"v2.8.12",
"v2.8.11",
"v2.7.21",
"v2.7.20",
"v2.7.19",
"v2.7.18",
"v2.8.10",
"v2.7.17",
"v2.8.9",
"v2.7.16",
"v2.7.15",
"v2.8.8",
"v2.8.7",
"v2.8.6",
"v2.7.14",
"v2.7.13",
"v2.8.5",
"v2.7.12",
"v2.8.4",
"v2.8.3",
"v2.7.10",
"v2.8.2",
"v2.7.9",
"v2.8.1",
"v2.7.8",
"v2.8.0",
"v2.7.7",
"v2.7.6",
"v2.7.5",
"v2.7.4",
"v2.7.3",
"v2.7.2",
"v2.7.1",
"v2.7.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11406.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/symfony/symfony",
"type": "GIT",
"events": [
{
"introduced": "9975b1eca3de4db792a2c3e4e16f676a4aadcd46"
},
{
"fixed": "34d6116e2b80351c5a6f591285a4e9381b0dd127"
},
{
"introduced": "5615b92cd452cd54f1433a3f53de87c096a1107f"
},
{
"fixed": "24fc640d544a67869a4106de5fc303c597398629"
},
{
"introduced": "5a7e31c48e7cd4831efa409fffb661beb9995174"
},
{
"fixed": "4639525c796227ec36652ad97192a5eb3de74f76"
},
{
"introduced": "0a47db379b8cc74cdd84e1e6870fafc4a4ac8351"
},
{
"fixed": "8eb567d8398ce31a402ea8db3e6b5b1faf121cbc"
},
{
"introduced": "26ca7023b1c45dce951da7206ed70049267d27bc"
},
{
"fixed": "a54fa082103acd599b7d5de9204dc1f4aa8a5615"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.48"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.41"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.17"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4.0"
},
{
"fixed": "3.4.11"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.11"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v4.0.10",
"v3.4.10",
"v2.8.40",
"v2.7.47",
"v4.0.9",
"v3.4.9",
"v2.8.39",
"v2.7.46",
"v4.0.8",
"v3.4.8",
"v2.8.38",
"v2.7.45",
"v4.0.7",
"v3.4.7",
"v2.8.37",
"v2.7.44",
"v4.0.6",
"v3.4.6",
"v2.8.36",
"v2.7.43",
"v4.0.5",
"v3.4.5",
"v2.8.35",
"v2.7.42",
"v4.0.4",
"v3.4.4",
"v3.3.16",
"v2.8.34",
"v2.7.41",
"v4.0.3",
"v3.4.3",
"v3.3.15",
"v2.8.33",
"v2.7.40",
"v4.0.2",
"v3.4.2",
"v4.0.1",
"v3.4.1",
"v3.3.14",
"v2.8.32",
"v2.7.39",
"v4.0.0",
"v3.4.0",
"v3.3.13",
"v2.8.31",
"v2.7.38",
"v3.3.12",
"v2.8.30",
"v2.7.37",
"v3.3.11",
"v2.8.29",
"v2.7.36",
"v3.3.10",
"v2.8.28",
"v2.7.35",
"v3.3.9",
"v3.3.8",
"v3.3.7",
"v2.8.27",
"v2.7.34",
"v2.7.33",
"v3.3.6",
"v2.8.26",
"v3.3.5",
"v2.8.25",
"v2.7.32",
"v3.3.4",
"v2.8.24",
"v2.7.31",
"v3.3.3",
"v2.8.23",
"v2.7.30",
"v2.8.22",
"v2.7.29",
"v3.3.2",
"v3.3.1",
"v3.3.0",
"v2.8.21",
"v2.7.28",
"v2.7.26",
"v2.8.20",
"v2.7.27",
"v2.8.18",
"v2.8.19",
"v2.7.25",
"v2.8.17",
"v2.7.24",
"v2.8.16",
"v2.7.23",
"v2.8.15",
"v2.7.22",
"v2.8.14",
"v2.7.21",
"v2.8.13",
"v2.7.20",
"v2.8.12",
"v2.7.19",
"v2.8.11",
"v2.7.18",
"v2.8.10",
"v2.7.17",
"v2.8.9",
"v2.7.16",
"v2.8.8",
"v2.7.15",
"v2.8.7",
"v2.7.14",
"v2.8.6",
"v2.7.13",
"v2.8.5",
"v2.7.12",
"v2.8.4",
"v2.7.11",
"v2.8.3",
"v2.7.10",
"v2.7.9",
"v2.8.2",
"v2.8.1",
"v2.7.8",
"v2.8.0",
"v2.7.7",
"v2.7.6",
"v2.7.5",
"v2.7.4",
"v2.7.3",
"v2.7.2",
"v2.7.1",
"v2.7.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11406.json"
}
}
],
"modified": "2026-10-24T10:30:54.864257429Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/",
"https://symfony.com/blog/cve-2018-11406-csrf-token-fixation",
"https://www.debian.org/security/2018/dsa-4262"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-11406",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 438294,
"published_at": "2018-06-13T16:29:00.813+00:00"
}