Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

symfony/security

17 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
17 · 1 high, 1 medium
Registry
Packagist

Advisories 17

  • CVE-2021-21424Medium 5.3

    Prevent user enumeration using Guard or the new Authenticator-based Security

    Affected: from 5.0.0, fixed in 5.2.8; from 2.8.0, fixed in 3.4.49; from 4.0.0, fixed in 4.4.24.

  • Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http

    Affected: from 4.4.0, fixed in 4.4.7; from 5.0.0, fixed in 5.0.7.

  • Certain Symfony products are affected by: Incorrect Access Control.

    Affected: from 2.7.30, fixed in 2.7.32; from 2.8.23, fixed in 2.8.25; from 3.2.10, fixed in 3.2.12; from 3.3.3, fixed in 3.3.5.

  • In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow…

    Affected: from 2.7.0, fixed in 2.7.51; from 2.8.0, fixed in 2.8.50; from 3.0.0, fixed in 3.4.26; from 4.0.0, fixed in 4.1.12; from 4.2.0, fixed in 4.2.7.

  • An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before…

    Affected: from 2.7.38, fixed in 2.7.50; from 2.8.0, fixed in 2.8.49; from 3.0.0, fixed in 3.4.19; from 4.0.0, fixed in 4.0.15; from 4.1.0, fixed in 4.1.9; from 4.2.0, fixed in 4.2.1.

  • An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5.

    Affected: from 2.7.0, fixed in 2.7.38; from 2.8.0, fixed in 2.8.31; from 3.0.0, fixed in 3.2.14; from 3.3.0, fixed in 3.3.13.

  • An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before…

    Affected: from 2.8.0, fixed in 2.8.37; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.7; from 4.0.0, fixed in 4.0.7.

  • An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before…

    Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11.

  • An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before…

    Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11.

  • An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13.

    Affected: from 2.7.0, fixed in 2.7.38; from 2.8.0, fixed in 2.8.31; from 3.2.0, fixed in 3.2.14; from 3.3.0, fixed in 3.3.13.

  • Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid…

    Affected: from 2.8.0, fixed in 2.8.6; from 3.0.0, fixed in 3.0.6.

  • The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before…

    Affected: from 2.3.0, fixed in 2.3.41; from 2.4.0, fixed in 2.7.13; from 2.8.0, fixed in 2.8.6; from 3.0.0, fixed in 3.0.6.

  • The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly…

    Affected: from 2.3.0, fixed in 2.3.37; from 2.4.0, fixed in 2.6.13; from 2.7.0, fixed in 2.7.9.

  • Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a…

    Affected: from 2.3.0, fixed in 2.3.35; from 2.4.0, fixed in 2.6.12; from 2.7.0, fixed in 2.7.7.

  • Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before…

    Affected: from 2.3.0, fixed in 2.3.35; from 2.4.0, fixed in 2.6.12; from 2.7.0, fixed in 2.7.7.

Show all 17 advisoriesShow fewer advisories

  • The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote…

    Affected: from 2.0.0, fixed in 2.0.25; from 2.1.0, fixed in 2.1.13; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.6.

  • Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote…

    Affected: from 2.0.0, fixed in 2.0.19.