CVE-2020-5255

2020-03-3020:15:19

Google

osv.dev

4.5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.9%

JSON

In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

CPENameOperatorVersion
security-httpeq4.3.10
security-httpeq4.4.6
security-httpeq3.4.38
security-httpeq4.4.4
security-httpeq3.4.40
security-httpeq5.0.1
security-httpeq5.0.2
security-httpeq4.4.2
security-httpeq5.0.5
security-httpeq4.4.7

Name	Operator	Version
security-http	eq	4.3.10
security-http	eq	4.4.6
security-http	eq	3.4.38
security-http	eq	4.4.4
security-http	eq	3.4.40
security-http	eq	5.0.1
security-http	eq	5.0.2
security-http	eq	4.4.2
security-http	eq	5.0.5
security-http	eq	4.4.7