-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from CSRF tokens not being differentiated between HTTP/HTTPS contexts. The key modification in the patch adds scheme-based namespacing to token IDs. The original implementations of these methods in CsrfTokenManager directly used user-provided token IDs without any scheme context, making them vulnerable to MITM attacks. The functions' pre-patch versions lacked the namespace logic seen in the diff (e.g., no $this->getNamespace() calls), allowing token reuse across protocols. The high confidence comes from the direct correlation between the vulnerability description and the specific code changes made in the security patch.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/security-csrf | composer | >= 2.7.0, < 2.7.38 | 2.7.38 |
| symfony/security-csrf | composer | >= 2.8.0, < 2.8.31 | 2.8.31 |
| symfony/security-csrf | composer | >= 3.0.0, < 3.2.14 | 3.2.14 |
| symfony/security-csrf | composer | >= 3.3.0, < 3.3.13 | 3.3.13 |
| symfony/security | composer | >= 2.7.0, < 2.7.38 | 2.7.38 |
| symfony/security | composer | >= 2.8.0, < 2.8.31 | 2.8.31 |
| symfony/security | composer | >= 3.0.0, < 3.2.14 | 3.2.14 |
| symfony/security | composer | >= 3.3.0, < 3.3.13 | 3.3.13 |
| symfony/symfony | composer | >= 2.7.0, < 2.7.38 | 2.7.38 |
| symfony/symfony | composer | >= 2.8.0, < 2.8.31 | 2.8.31 |
| symfony/symfony | composer | >= 3.0.0, < 3.2.14 | 3.2.14 |
| symfony/symfony | composer | >= 3.3.0, < 3.3.13 | 3.3.13 |