{"id":"GHSA-6mjq-9x4w-m3w9","aliases":[],"title":"FOSUserBundle Session Hijacking Vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"Versions of FOSUserBundle from 1.2.x to 1.2.4 have been found to contain a security vulnerability related to session hijacking. This issue has been addressed in version 1.2.4, and users are strongly advised to upgrade to the latest version to prevent potential session-related security risks.","severity":"high","score":null,"published":"2024-05-15T21:42:56.000Z","modified":"2024-11-29T05:40:46.397Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"friendsofsymfony/user-bundle","sources":[{"name":"OSV · GHSA-6mjq-9x4w-m3w9","url":"https://osv.dev/vulnerability/GHSA-6mjq-9x4w-m3w9"}],"ranges":[{"events":[{"introduced":"1.2.0"},{"fixed":"1.2.4"}],"type":"ECOSYSTEM"}],"versions":["1.2.0","v1.2.1","v1.2.2","v1.2.3"],"fixed":["1.2.4"]}],"sourceAffected":[],"references":["https://github.com/FriendsOfSymfony/FOSUserBundle/commit/8e412a70cafd924ad04c7325dae423048861b955","https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/user-bundle/2012-07-10-2.yaml","https://github.com/FriendsOfSymfony/FOSUserBundle","https://github.com/FriendsOfSymfony/FOSUserBundle/blob/master/Changelog.md"],"sources":[{"name":"OSV","id":"GHSA-6mjq-9x4w-m3w9","modified":"2024-11-29T05:40:46.397504Z","url":"https://osv.dev/vulnerability/GHSA-6mjq-9x4w-m3w9"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T18:20:33.032Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}