CVE-2015-8125

2015-12-0700:00:00

ubuntu.com

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.011 Low

EPSS

Percentile

84.2%

JSON

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7
might allow remote attackers to have unspecified impact via a timing attack
involving the (1)
Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices
or (2)
Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class
in the Symfony Security Component, or (3) legacy CSRF implementation from
the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider
class in the Symfony Form component.