CVE-2015-4050

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or…

published June 2, 2015

CVSS
—
EPSS
8%
Percentile
94.8
In the wild
Unconfirmed
What it is

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08211 · 94.8th percentile
Published
2015-06-02T14:00Z
EPSS history
Timeline
  • 02 JUN 14:00Z
    FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or…
    cvelistv5