PT-2021-3455 · Symfony · Symfony

🗓️ 17 Jun 2021 00:00:00Reported by Positive TechnologiesType

Symfony firewall flaw lets tokens from one firewall be valid for others; affects 5.3.0–5.3.1; upgrade to 5.3.2+ or limit access.

Reporter	Title	Published	Views	Family All 21
attackerkb	CVE-2021-32693	17 Jun 202123:15	–	attackerkb
BDU FSTEC	Symfony Privilege Escalation	30 Jun 202100:00	–	bdu_fstec
CNNVD	Sensio Labs Symfony authorization issue vulnerability	17 Jun 202100:00	–	cnnvd
CNVD	Symfony Elevation of Privilege Vulnerability	22 Jun 202100:00	–	cnvd
CVE	CVE-2021-32693	17 Jun 202122:40	–	cve
Cvelist	CVE-2021-32693 Authentication granted with multiple firewalls	17 Jun 202122:40	–	cvelist
Debian CVE	CVE-2021-32693	17 Jun 202122:40	–	debiancve
EUVD	EUVD-2021-1396	7 Oct 202500:30	–	euvd
Friends Of PHP	CVE-2021-32693: Authentication granted to all firewalls instead of just one	17 Jun 202115:00	–	friendsofphp
Friends Of PHP	CVE-2021-32693: Authentication granted to all firewalls instead of just one	17 Jun 202115:00	–	friendsofphp

Source	Link
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-32693.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2021-32693.yaml
github	www.github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrq
github	www.github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728
github	www.github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-32693
osv	www.osv.dev/vulnerability/CVE-2021-32693
bdu	www.bdu.fstec.ru/vul/2021-03315
safe-surf	www.safe-surf.ru/specialists/bulletins-nkcki/666747
symfony	www.symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-one

06 Mar 2024 00:00Current

8.4High risk

Vulners AI Score8.4

CVSS 26.5 - 9

CVSS 3.16.8 - 8.8

EPSS0.01388