Lucene search

[email protected]NVD:CVE-2015-8125

HistoryDec 07, 2015 - 8:59 p.m.

CVE-2015-8125

2015-12-0720:59:15

[email protected]

web.nvd.nist.gov

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.8 Medium

AI Score

Confidence

Low

0.011 Low

EPSS

Percentile

84.2%

JSON

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Affected configurations

NVD

Node

sensiolabssymfonyMatch2.3.0

sensiolabssymfonyMatch2.3.1

sensiolabssymfonyMatch2.3.2

sensiolabssymfonyMatch2.3.3

sensiolabssymfonyMatch2.3.4

sensiolabssymfonyMatch2.3.5

sensiolabssymfonyMatch2.3.6

sensiolabssymfonyMatch2.3.7

sensiolabssymfonyMatch2.3.8

sensiolabssymfonyMatch2.3.9

sensiolabssymfonyMatch2.3.10

sensiolabssymfonyMatch2.3.11

sensiolabssymfonyMatch2.3.12

sensiolabssymfonyMatch2.3.13

sensiolabssymfonyMatch2.3.14

sensiolabssymfonyMatch2.3.15

sensiolabssymfonyMatch2.3.16

sensiolabssymfonyMatch2.3.17

sensiolabssymfonyMatch2.3.18

sensiolabssymfonyMatch2.3.19

sensiolabssymfonyMatch2.3.20

sensiolabssymfonyMatch2.3.21

sensiolabssymfonyMatch2.3.22

sensiolabssymfonyMatch2.3.23

sensiolabssymfonyMatch2.3.24

sensiolabssymfonyMatch2.3.25

sensiolabssymfonyMatch2.3.26

sensiolabssymfonyMatch2.3.27

sensiolabssymfonyMatch2.3.28

sensiolabssymfonyMatch2.3.29

sensiolabssymfonyMatch2.3.30

sensiolabssymfonyMatch2.3.31

sensiolabssymfonyMatch2.3.32

sensiolabssymfonyMatch2.3.33

sensiolabssymfonyMatch2.3.34

sensiolabssymfonyMatch2.6.0

sensiolabssymfonyMatch2.6.1

sensiolabssymfonyMatch2.6.2

sensiolabssymfonyMatch2.6.3

sensiolabssymfonyMatch2.6.4

sensiolabssymfonyMatch2.6.5

sensiolabssymfonyMatch2.6.6

sensiolabssymfonyMatch2.6.7

sensiolabssymfonyMatch2.6.8

sensiolabssymfonyMatch2.6.9

sensiolabssymfonyMatch2.6.10

sensiolabssymfonyMatch2.6.11

sensiolabssymfonyMatch2.7.0

sensiolabssymfonyMatch2.7.1

sensiolabssymfonyMatch2.7.2

sensiolabssymfonyMatch2.7.3

sensiolabssymfonyMatch2.7.4

sensiolabssymfonyMatch2.7.5

sensiolabssymfonyMatch2.7.6

References

lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html

lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html

www.debian.org/security/2015/dsa-3402

www.securityfocus.com/bid/77692

symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.8 Medium

AI Score

Confidence

Low

0.011 Low

EPSS

Percentile

84.2%

JSON

Related for NVD:CVE-2015-8125

debiancve1 prion1 cve1 friendsofphp4 symfony1 osv2 cvelist1 github1 ubuntucve1 openvas4 fedora4 debian2 nessus3