CVE-2012-6432

Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /internal substring...

CVE-2012-6432

Summary (concrete details from provided sources): CVE-2012-6432 affects Symfony 2.0.x up to 2.0.19, Symfony 2.1.x up to 2.1.4, and 2.2-dev, when the internal routes configuration is enabled. A vulnerability in the internal routing mechanism, via URIs starting with /_internal, allows an attacker t...

Security release: Symfony 2.0.20 and 2.1.5 released

Log in to add a reaction to this post add a reaction ❤️ 👍 🚀 Symfony 2.0.20 and Symfony 2.1.5 have just been released and they both contain two security fixes. CVE-2012-6431: Routes behind a firewall are accessible even when not logged in Affected versions All versions from 2.0.0 to 2.0.19 are...