PT-2020-18349 · Symfony · Symfony

🗓️ 30 Mar 2020 00:00:00Reported by Positive TechnologiesType

When no Content-Type header is present, Symfony may use Accept to set content type, causing mismatches.

Reporter	Title	Published	Views	Family All 19
CNVD	Sensio Labs Symfony Input Validation Error Vulnerability	31 Mar 202000:00	–	cnvd
CVE	CVE-2020-5255	30 Mar 202019:30	–	cve
Cvelist	CVE-2020-5255 Prevent cache poisoning via a Response Content-Type header	30 Mar 202019:30	–	cvelist
Debian CVE	CVE-2020-5255	30 Mar 202019:30	–	debiancve
EUVD	EUVD-2020-0351	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 32 Update: php-symfony4-4.4.7-1.fc32	9 Apr 202014:45	–	fedora
Friends Of PHP	CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header	30 Mar 202014:00	–	friendsofphp
Friends Of PHP	CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header	30 Mar 202014:00	–	friendsofphp
Github Security Blog	Prevent cache poisoning via a Response Content-Type header in Symfony	30 Mar 202020:09	–	github
NVD	CVE-2020-5255	30 Mar 202020:15	–	nvd

Source	Link
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2020-5255.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2020-5255.yaml
github	www.github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6
osv	www.osv.dev/vulnerability/CVE-2020-5255
osv	www.osv.dev/vulnerability/GHSA-mcx4-f5f5-4859
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-5255
osv	www.osv.dev/vulnerability/BIT-symfony-2020-5255
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-5255

06 Mar 2024 00:00Current

4.4Medium risk

Vulners AI Score4.4

CVSS 3.12.6 - 4.3

CVSS 24

EPSS0.00374