CVE-2015-4050

2015-06-0214:59:00

CWE-284

[email protected]

web.nvd.nist.gov

cve-2015-4050

symfony

httpkernel

security bypass

esi

ssi

remote attack

url signing

6.4 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.006 Low

EPSS

Percentile

78.2%

JSON

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

CPENameOperatorVersion
sensiolabs:symfonysensiolabs symfonyeq2.3.21
sensiolabs:symfonysensiolabs symfonyeq2.5.4
sensiolabs:symfonysensiolabs symfonyeq2.3.27
sensiolabs:symfonysensiolabs symfonyeq2.4.10
sensiolabs:symfonysensiolabs symfonyeq2.6.1
sensiolabs:symfonysensiolabs symfonyeq2.5.7
sensiolabs:symfonysensiolabs symfonyeq2.3.28
sensiolabs:symfonysensiolabs symfonyeq2.6.5
sensiolabs:symfonysensiolabs symfonyeq2.3.22
sensiolabs:symfonysensiolabs symfonyeq2.6.3

CPE	Name	Operator	Version
sensiolabs:symfony	sensiolabs symfony	eq	2.3.21
sensiolabs:symfony	sensiolabs symfony	eq	2.5.4
sensiolabs:symfony	sensiolabs symfony	eq	2.3.27
sensiolabs:symfony	sensiolabs symfony	eq	2.4.10
sensiolabs:symfony	sensiolabs symfony	eq	2.6.1
sensiolabs:symfony	sensiolabs symfony	eq	2.5.7
sensiolabs:symfony	sensiolabs symfony	eq	2.3.28
sensiolabs:symfony	sensiolabs symfony	eq	2.6.5
sensiolabs:symfony	sensiolabs symfony	eq	2.3.22
sensiolabs:symfony	sensiolabs symfony	eq	2.6.3