{"id":"CVE-2022-24894","aliases":["BIT-symfony-2022-24894","GHSA-h7vf-5wrv-9fhv"],"url":"https://o3.security/vulnerability/CVE-2022-24894","summary":"Symfony storing cookie headers in HttpCache","details":"Description\n-----------\n\nThe Symfony HTTP cache system acts as a reverse proxy: it caches HTTP responses (including headers) and returns them to clients.\n\nIn a recent `AbstractSessionListener` change, the response might now contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this header might be stored and returned to some other clients. An attacker can use this vulnerability to retrieve the victim's session.\n\nResolution\n----------\n\nThe `HttpStore` constructor now takes a parameter containing a list of private headers that are removed from the HTTP response headers.\nThe default value for this parameter is `Set-Cookie`, but it can be overridden or extended by the application.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb) for branch 4.4.\n\nCredits\n-------\n\nWe would like to thank Soner Sayakci for reporting the issue and Nicolas Grekas for fixing it.","published":"2023-02-03T21:46:23.702Z","modified":"2026-08-12T03:51:22.097762795Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L"},"epss":{"score":0.03998,"percentile":0.90025,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"symfony/http-kernel","fixedVersion":"4.4.50"},{"ecosystem":"Packagist","name":"symfony/http-kernel","fixedVersion":"5.4.20"},{"ecosystem":"Packagist","name":"symfony/http-kernel","fixedVersion":"6.0.20"},{"ecosystem":"Packagist","name":"symfony/http-kernel","fixedVersion":"6.1.12"},{"ecosystem":"Packagist","name":"symfony/http-kernel","fixedVersion":"6.2.6"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"4.4.50"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"5.4.20"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"6.0.20"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"6.1.12"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"6.2.6"}],"fix":{"url":"https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb","label":"symfony/symfony@d2f6322"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24894.json"},{"type":"ADVISORY","url":"https://github.com/symfony/symfony/security/advisories/GHSA-h7vf-5wrv-9fhv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24894"},{"type":"FIX","url":"https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2022-24894.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2022-24894.yaml"},{"type":"PACKAGE","url":"https://github.com/symfony/symfony"},{"type":"WEB","url":"https://symfony.com/cve-2022-24894"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:22.097762795Z"}}