GHSA-6mjq-9x4w-m3w9: 
PHP vulnerability analysis and mitigation

FOSUserBundle versions from 1.2.0 to 1.2.4 contained a critical security vulnerability related to session hijacking. The vulnerability was discovered and fixed in version 1.2.4, which was released on July 10, 2012. This security issue affected the FriendsOfSymfony/user-bundle package, a popular Symfony bundle for user management (GitHub Advisory).

The vulnerability was present in the authentication implementation of FOSUserBundle, specifically affecting the session handling mechanism. The issue was severe enough to warrant an immediate security release, indicating a high-severity vulnerability that could potentially allow unauthorized access to user sessions (Changelog).

The vulnerability could allow malicious actors to hijack user sessions, potentially gaining unauthorized access to user accounts and their associated data. Given the nature of session hijacking vulnerabilities, this could lead to complete account compromise for affected users (GitHub Advisory).

While specific exploit details were not publicly disclosed, the vulnerability was considered serious enough to warrant an immediate security release. The issue affected all installations of FOSUserBundle versions 1.2.0 through 1.2.3 (Security Advisory).

The recommended mitigation is to upgrade to FOSUserBundle version 1.2.4 or later. The fix was implemented through changes in the authentication system and session handling mechanism, as evidenced by the security patch (Changelog).