p PatchFirst

PatchFirst · Latest vulnerabilities

symfony/framework-bundle vulnerabilities

Vulnerabilities published for symfony/framework-bundle in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2014-4931

    High · CVSS 7.5Fix available

    Code injection in the way Symfony implements translation caching in FrameworkBundle

    When investigating issue [#11093](https://github.com/symfony/symfony/issues/11093), [Jeremy Derussé](https://connect.sensiolabs.com/profile/jderusse) found a serious code injection issue in the way Symfony implements translation caching in FrameworkBundle. - Your Symfony application is vulnerable if you meet the following conditions: - You are using the Symfony translation system from FrameworkBundle (so basically if you are using Symfony full-stack -- you are not affected if you are using the Translation component with Silex for instance); You don't sanitize locales coming from a URL (any route with a _locale argument for instance): When

    symfony/framework-bundle symfony/framework-bundle symfony/framework-bundlePHP
    • Update to 2.3.18
    • Update to 2.4.8
    • Update to 2.5.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2022-23601

    High · CVSS 8.1EPSS 0.57%Fix available

    CSRF token missing in Symfony

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled. In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form

    symfony/framework-bundle symfony/framework-bundle symfony/framework-bundlePHP
    • Update to 5.3.15
    • Update to 5.4.4
    • Update to 6.0.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2019-10909

    Medium · CVSS 5.4EPSS 1.03%Fix available

    CVE-2019-10909

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

    symfony/framework-bundle symfony/framework-bundle symfony/framework-bundle symfony/framework-bundle symfony/framework-bundlePHP
    • Update to 2.7.51
    • Update to 2.8.50
    • Update to 3.4.26
    • Update to 4.1.12
    • Update to 4.2.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →