{"id":"GHSA-qmqw-mpqp-mr54","summary":"Symfony Incorrect Access Control","details":"FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the `_controller` attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to `/_fragment`.\n\nThis issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.","aliases":["CVE-2015-4050"],"modified":"2024-12-05T05:42:42.499490Z","published":"2022-05-17T03:11:51Z","database_specific":{"github_reviewed_at":"2023-08-03T21:47:36Z","nvd_published_at":"2015-06-02T14:59:00Z","cwe_ids":["CWE-284"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4050"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2015-4050.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-4050.yaml"},{"type":"WEB","url":"https://symfony.com/cve-2015-4050"},{"type":"WEB","url":"https://web.archive.org/web/20200228090443/http://www.securityfocus.com/bid/74928"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html"},{"type":"WEB","url":"http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access"},{"type":"WEB","url":"http://www.debian.org/security/2015/dsa-3276"}],"affected":[{"package":{"name":"symfony/http-kernel","ecosystem":"Packagist","purl":"pkg:composer/symfony/http-kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.19"},{"fixed":"2.3.29"}]}],"versions":["v2.3.19","v2.3.20","v2.3.21","v2.3.22","v2.3.23","v2.3.24","v2.3.25","v2.3.26","v2.3.27","v2.3.28"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmqw-mpqp-mr54/GHSA-qmqw-mpqp-mr54.json"}},{"package":{"name":"symfony/http-kernel","ecosystem":"Packagist","purl":"pkg:composer/symfony/http-kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.4"},{"fixed":"2.5.12"}]}],"versions":["v2.5.10","v2.5.11","v2.5.4","v2.5.5","v2.5.6","v2.5.7","v2.5.8","v2.5.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmqw-mpqp-mr54/GHSA-qmqw-mpqp-mr54.json"}},{"package":{"name":"symfony/http-kernel","ecosystem":"Packagist","purl":"pkg:composer/symfony/http-kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.8"}]}],"versions":["v2.6.0","v2.6.1","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.6.6","v2.6.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmqw-mpqp-mr54/GHSA-qmqw-mpqp-mr54.json"}},{"package":{"name":"symfony/symfony","ecosystem":"Packagist","purl":"pkg:composer/symfony/symfony"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.19"},{"fixed":"2.3.29"}]}],"versions":["v2.3.19","v2.3.20","v2.3.21","v2.3.22","v2.3.23","v2.3.24","v2.3.25","v2.3.26","v2.3.27","v2.3.28"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmqw-mpqp-mr54/GHSA-qmqw-mpqp-mr54.json"}},{"package":{"name":"symfony/symfony","ecosystem":"Packagist","purl":"pkg:composer/symfony/symfony"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9"},{"last_affected":"2.4.10"}]}],"versions":["v2.4.10","v2.4.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmqw-mpqp-mr54/GHSA-qmqw-mpqp-mr54.json"}},{"package":{"name":"symfony/symfony","ecosystem":"Packagist","purl":"pkg:composer/symfony/symfony"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.4"},{"fixed":"2.5.12"}]}],"versions":["v2.5.10","v2.5.11","v2.5.4","v2.5.5","v2.5.6","v2.5.7","v2.5.8","v2.5.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmqw-mpqp-mr54/GHSA-qmqw-mpqp-mr54.json"}},{"package":{"name":"symfony/symfony","ecosystem":"Packagist","purl":"pkg:composer/symfony/symfony"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.8"}]}],"versions":["v2.6.0","v2.6.1","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.6.6","v2.6.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmqw-mpqp-mr54/GHSA-qmqw-mpqp-mr54.json"}},{"package":{"name":"symfony/http-kernel","ecosystem":"Packagist","purl":"pkg:composer/symfony/http-kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9"},{"last_affected":"2.4.10"}]}],"versions":["v2.4.10","v2.4.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmqw-mpqp-mr54/GHSA-qmqw-mpqp-mr54.json"}}],"schema_version":"1.9.0"}