PT-2021-3445 · Symfony +3 · Symfony +3

🗓️ 13 May 2021 00:00:00Reported by Positive TechnologiesType

Symfony before 3.4 allows user enumeration via switch users and timing attack, revealing protected data.

Reporter	Title	Published	Views	Family All 162
AstraLinux	Astra Linux - уязвимость в symfony	20 May 202605:53	–	astralinux
AstraLinux	Astra Linux - уязвимость в symfony	20 May 202605:53	–	astralinux
AstraLinux	Astra Linux - уязвимость в symfony	20 May 202605:53	–	astralinux
Circl	CVE-2021-21424	15 Apr 202505:00	–	circl
Circl	CVE-2021-41270	24 Nov 202122:27	–	circl
CNNVD	Sensio Labs Symfony 信息泄露漏洞	12 May 202100:00	–	cnnvd
CNNVD	Sensio Labs Symfony 安全漏洞	24 Nov 202100:00	–	cnnvd
CNNVD	Sensio Labs Symfony 授权问题漏洞	3 Feb 202300:00	–	cnnvd
CNNVD	Sensio Labs Symfony 授权问题漏洞	3 Feb 202300:00	–	cnnvd
CVE	CVE-2021-21424	13 May 202100:00	–	cve

Source	Link
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-21424.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-guard/CVE-2021-21424.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2021-21424.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/maker-bundle/CVE-2021-21424.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2021-21424.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/lexik/jwt-authentication-bundle/CVE-2021-21424.yaml
github	www.github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68
github	www.github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011
bdu	www.bdu.fstec.ru/vul/2021-03305
wiki	www.wiki.astralinux.ru/pages/viewpage.action

06 Mar 2024 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.3 - 8.8

CVSS 25

EPSS0.00871

SSVC