Skip to content

Product

symfony/security vulnerabilities

17 published CVES affecting symfony/security, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
17
Critical
3
High
7
Medium
7
Low
0
Unscored
0
CISA KEV
0

Latest symfony/security CVEs

Newest publication first

  3. CVE-2017-11365 Symfony Incorrect Access Control

    Published
    CriticalCVSS 9.8 EPSS 1.9% PoC

    Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.

  4. CVE-2019-10911 Improper authentication in Symfony

    Published
    HighCVSS 7.5 EPSS 1.2% PoC

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related t...

  5. CVE-2018-19790 Symfony Open Redirect

    Published
    MediumCVSS 6.1 EPSS 1.5% PoC

    An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the _failure_path input field of login forms, an attacker can work around the redirectio...

  6. CVE-2017-16653 Symfony CSRF Vulnerability

    Published
    MediumCVSS 5.9 EPSS 1.5% PoC

    An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and...

  7. CVE-2017-16652 Symfony Open Redirect

    Published
    MediumCVSS 6.1 EPSS 0.77% PoC

    An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates a redirect response,...

  8. CVE-2018-11385 Symfony Session Fixation Vulnerability

    Published
    HighCVSS 8.1 EPSS 2.0% PoC

    An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victi...

  9. CVE-2018-11406 Symfony CSRF Token Fixation

    Published
    HighCVSS 8.8 EPSS 0.75% PoC

    An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through...

  10. CVE-2018-11407 Symfony Authentication Bypass

    Published
    CriticalCVSS 9.8 EPSS 2.4% PoC

    An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenti...

  11. CVE-2016-2403 Symfony Authentication Bypass

    Published
    CriticalCVSS 9.8 EPSS 4.3% PoC

    Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.

  12. CVE-2016-4423 Symphony Denial of Service Via Overlong Usernames

    Published
    HighCVSS 7.5 EPSS 1.9% PoC

    The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allow...

  13. CVE-2016-1902 Symfony Cryptographic Vulnerability

    Published
    HighCVSS 7.5 EPSS 1.9% PoC

    The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails,...

  14. CVE-2015-8124 Symfony Session Fixation Vulnerability

    Published
    MediumCVSS 6.8 EPSS 2.7% PoC

    Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.

  15. CVE-2015-8125 Symfony Vulnerable to Timing Attack

    Published
    HighCVSS 7.5 EPSS 2.5% PoC

    Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Securi...

  16. CVE-2013-5958 Symfony Denial of Service Via Long Password Hashing

    Published
    MediumCVSS 5.0 EPSS 1.9% PoC

    The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKD...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.