CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2021-21424 – Prevent user enumeration using Guard or the new Authenticator-based Security
https://notcve.org/view.php?id=CVE-2021-21424
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4. Symfony es un framework PHP para aplicaciones web y de consola y un conjunto de componentes PHP reutilizables. • https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011 https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68 https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KENRNLB3FYXYGDWRBH2PDBOZZKOD7VY4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH7TMM5CHQYBFFGXWRPJDPB3SKCZXI2M https://lists.fedoraproject.org/archives/list/package-announce%40lists.fe • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2019-11325
https://notcve.org/view.php?id=CVE-2019-11325
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter. Se detectó un problema en Symfony versiones anteriores a 4.2.12 y versiones 4.3.x anteriores a 4.3.8. El componente VarExport escapa incorrectamente las cadenas, lo que permite a algunas especialmente diseñadas escalar a la ejecución de código PHP arbitrario. • https://github.com/symfony/symfony/releases/tag/v4.3.8 https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3 https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter https://symfony.com/blog/symfony-4-3-8-released • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-18886
https://notcve.org/view.php?id=CVE-2019-18886
An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security. Se detectó un problema en Symfony versiones 4.2.0 hasta 4.2.11 y 4.3.0 hasta 4.3.7. La capacidad para enumerar usuarios fue posible debido a un manejo diferente dependiendo de si el usuario existía cuando se realizaron intentos no autorizados de utilizar la funcionalidad switch users. • https://github.com/symfony/symfony/releases/tag/v4.3.8 https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality https://symfony.com/blog/symfony-4-3-8-released • CWE-203: Observable Discrepancy •
CVSS: 8.1EPSS: 1%CPEs: 6EXPL: 0CVE-2019-18887
https://notcve.org/view.php?id=CVE-2019-18887
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel. Se detectó un problema en Symfony versiones 2.8.0 hasta 2.8.50, 3.4.0 hasta 3.4.34, 4.2.0 hasta 4.2.11 y 4.3.0 hasta 4.3.7. El UriSigner estaba sujeto a ataques de sincronización. • https://github.com/symfony/symfony/releases/tag/v4.3.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner https://symfony.com/blog/ • CWE-203: Observable Discrepancy •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-18888
https://notcve.org/view.php?id=CVE-2019-18888
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x). Se detectó un problema en Symfony versiones 2.8.0 hasta 2.8.50, 3.4.0 hasta 3.4.34, 4.2.0 hasta 4.2.11 y 4.3.0 hasta 4.3.7. Si una aplicación pasa una entrada de usuario no validada como el archivo para el que debe llevarse a cabo la validación de tipo MIME, entonces argumentos arbitrarios son pasados al comando de archivo subyacente. • https://github.com/symfony/symfony/releases/tag/v4.3.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser https://symfony.com/blog • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •