PT-2020-18364 · Symfony · Symfony +1

🗓️ 30 Mar 2020 00:00:00Reported by Positive TechnologiesType

Symfony ErrorHandler exposed unescaped Exception properties; fixed to escape them and show stacktrace only in debug mode.

Reporter	Title	Published	Views	Family All 16
CNVD	Unspecified Vulnerability in Sensio Labs Symfony (CNVD-2020-29879)	31 Mar 202000:00	–	cnvd
CVE	CVE-2020-5274	30 Mar 202019:40	–	cve
Cvelist	CVE-2020-5274 Exceptions displayed in non-debug configurations in Symfony	30 Mar 202019:40	–	cvelist
Debian CVE	CVE-2020-5274	30 Mar 202019:40	–	debiancve
EUVD	EUVD-2020-0350	7 Oct 202500:30	–	euvd
Friends Of PHP	CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler	30 Mar 202014:00	–	friendsofphp
Friends Of PHP	CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler	30 Mar 202014:00	–	friendsofphp
Github Security Blog	Exceptions displayed in non-debug configurations in Symfony	30 Mar 202020:09	–	github
NVD	CVE-2020-5274	30 Mar 202020:15	–	nvd
OpenVAS	Symfony 4.4.x < 4.4.4, 5.0.x < 5.0.4 Information Disclosure Vulnerability	1 Apr 202000:00	–	openvas

Source	Link
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/error-handler/CVE-2020-5274.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2020-5274.yaml
github	www.github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5ad
github	www.github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45db
osv	www.osv.dev/vulnerability/CVE-2020-5274
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-5274
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-5274
osv	www.osv.dev/vulnerability/GHSA-m884-279h-32v2
osv	www.osv.dev/vulnerability/BIT-symfony-2020-5274
github	www.github.com/symfony/symfony/security/advisories/GHSA-m884-279h-32v2

06 Mar 2024 00:00Current

5.2Medium risk

Vulners AI Score5.2

CVSS 25.5

CVSS 3.14.6 - 5.4

EPSS0.00267