CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2021-21424 – Prevent user enumeration using Guard or the new Authenticator-based Security
https://notcve.org/view.php?id=CVE-2021-21424
13 May 2021 — Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4. Symfony es un framework PHP ... • https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 8.8EPSS: 2%CPEs: 6EXPL: 0CVE-2020-15094 – RCE in Symfony
https://notcve.org/view.php?id=CVE-2020-15094
02 Sep 2020 — In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request bei... • https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78 • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-5275 – Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http
https://notcve.org/view.php?id=CVE-2020-5275
30 Mar 2020 — In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7... • https://github.com/symfony/symfony/commit/c935e4a3fba6cc2ab463a6ca382858068d63cebf • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-5274 – Exceptions displayed in non-debug configurations in Symfony
https://notcve.org/view.php?id=CVE-2020-5274
30 Mar 2020 — In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5 En Symfony versiones anteriores a 5.0.5 y 4.4.5, algunas propiedades de la Excepción no ... • https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45db • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-5255 – Prevent cache poisoning via a Response Content-Type header
https://notcve.org/view.php?id=CVE-2020-5255
30 Mar 2020 — In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7. En Symfony en versiones anteriores a las versiones 4.4.7 y 5.0.7, cuando una... • https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6 • CWE-20: Improper Input Validation CWE-435: Improper Interaction Between Multiple Correctly-Behaving Entities •