CVE-2021-32693: Authentication granted to all firewalls instead of just one

Affected versions¶ Symfony >= 5.3.0, <5.3.2 versions of the Symfony Security HTTP component is affected by this security issue. The issue has been fixed in Symfony 5.3.2. Description¶ When an application defines multiple firewalls, the authenticated token delivered by one of the firewalls is available to all other firewalls. This can be abused when the application defines different providers for different parts of an application. In such a situation, a user authenticated on one part of the application is considered authenticated on the whole application. We now ensure that the authenticated token is only available for the firewall that generates it. The patch for this issue is available here for branch 5.3. Credits¶ I would like to thank Bogdan, gndk, Paweł Warchoł, Warxcell, and Adrien Lamotte for reporting the issue and Wouter J for fixing the issue.

                Sponsor the Symfony project.

http://feedproxy.google.com/~r/symfony/blog/~3/qkbXuTdSlRU/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-one

Created 4y | Jun 17, 2021, 3:20:16 PM


Login to add comment

Other posts in this group

SymfonyOnline June 2025: How Doctrine Events Ruined My Day(s)

SymfonyOnline June 2025 is almost here, starting in almost 2 months on:

June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe

Apr 25, 2025, 1:40:15 PM | Symfony
Introducing A Streaming AMQP Transport for Symfony Messenger

Symfony's Messenger component makes it easy to build message-driven applications. However, developers using symfony/amqp-messenger have long faced a limitation: it relies on polling (get()), which can

Apr 25, 2025, 9:10:02 AM | Symfony
SymfonyLive Berlin 2025: Recap and Replay !

SymfonyLive Berlin 2025 took place just 3 weeks ago!

A huge thank you to everyone who joined us!🔥 The conference brought together the local Symfony community in the heart of Berlin for two da

Apr 24, 2025, 2:30:18 PM | Symfony
New in Symfony 7.3: Global Translation Parameters

Contributed by Hubert Lenoir in

Apr 24, 2025, 7:30:24 AM | Symfony
SymfonyOnline June 2025: FormFlow: Build Stunning Multistep Forms

SymfonyOnline June 2025 is almost here, starting in almost 2 months on:

June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe

Apr 23, 2025, 3:20:21 PM | Symfony
New in Symfony 7.3: Assets Pre-Compression

Contributed by Kévin Dunglas in

Apr 23, 2025, 8:20:31 AM | Symfony
SymfonyOnline June 2025: Inside a Financial App Breach: Debugging a Million-Dollar Bug

SymfonyOnline June 2025 is almost here, starting in almost 2 months on:

June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe

Apr 22, 2025, 1:50:03 PM | Symfony