--- title: "symfony symfony/security vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/symfony/symfony-security type: product description: "symfony symfony/security has 17 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2021-05-13 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # symfony symfony/security vulnerabilities Vendor: [symfony](https://radicalnotion.ai/vendor/symfony) - **Published CVEs:** 17 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 17 - **Average CVSS:** 7.2 - **First CVE:** 2012-12-27 - **Latest CVE:** 2021-05-13 - **Ecosystems:** composer ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 3 | | High | 7 | | Medium | 6 | | Low | 1 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-287](https://radicalnotion.ai/cwe/cwe-287) | Improper Authentication | 3 | | [CWE-399](https://radicalnotion.ai/cwe/cwe-399) | Resource Management Errors | 2 | | [CWE-601](https://radicalnotion.ai/cwe/cwe-601) | URL Redirection to Untrusted Site ('Open Redirect') | 2 | | [CWE-285](https://radicalnotion.ai/cwe/cwe-285) | Improper Authorization | 1 | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 1 | | [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 1 | | [CWE-384](https://radicalnotion.ai/cwe/cwe-384) | Session Fixation | 1 | | [CWE-310](https://radicalnotion.ai/cwe/cwe-310) | Cryptographic Issues | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2012 | 1 | | 2013 | 0 | | 2014 | 1 | | 2015 | 2 | | 2016 | 2 | | 2017 | 1 | | 2018 | 6 | | 2019 | 2 | | 2020 | 1 | | 2021 | 1 | ## Affected versions (top 24 of 95) | Version | Kind | CVEs | | --- | --- | --- | | 3.0.0 \<= v \< 3.3.17 | range | 3 | | 2.3.0 \<= v \< 2.3.35 | range | 2 | | 2.4.0 \<= v \< 2.6.12 | range | 2 | | 2.7.0 \<= v \< 2.7.38 | range | 2 | | 2.7.0 \<= v \< 2.7.48 | range | 2 | | 2.7.0 \<= v \< 2.7.7 | range | 2 | | 2.8.0 \<= v \< 2.8.31 | range | 2 | | 2.8.0 \<= v \< 2.8.41 | range | 2 | | 2.8.0 \<= v \< 2.8.6 | range | 2 | | 3.0.0 \<= v \< 3.0.6 | range | 2 | | 3.3.0 \<= v \< 3.3.13 | range | 2 | | 3.4.0 \<= v \< 3.4.11 | range | 2 | | 3.3.17 | patched | 3 | | 2.3.35 | patched | 2 | | 2.6.12 | patched | 2 | | 2.7.38 | patched | 2 | | 2.7.48 | patched | 2 | | 2.7.7 | patched | 2 | | 2.8.31 | patched | 2 | | 2.8.41 | patched | 2 | | 2.8.6 | patched | 2 | | 3.0.6 | patched | 2 | | 3.2.14 | patched | 2 | | 3.3.13 | patched | 2 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2021-21424 | Prevent user enumeration using Guard or the new Authenticator-based Security | medium | 5.3 | No | No | Yes | | CVE-2020-5275 | Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http | high | 8.1 | No | No | Yes | | CVE-2017-11365 | Symfony Incorrect Access Control | critical | 9.8 | No | No | Yes | | CVE-2019-10911 | Improper authentication in Symfony | high | 7.5 | No | No | Yes | | CVE-2018-19790 | Symfony Open Redirect | medium | 6.1 | No | No | Yes | | CVE-2017-16653 | Symfony CSRF Vulnerability | medium | 5.9 | No | No | Yes | | CVE-2018-11407 | Symfony Authentication Bypass | critical | 9.8 | No | No | Yes | | CVE-2018-11406 | Symfony CSRF Token Fixation | high | 8.8 | No | No | Yes | | CVE-2018-11385 | Symfony Session Fixation Vulnerability | high | 8.1 | No | No | Yes | | CVE-2017-16652 | Symfony Open Redirect | medium | 6.1 | No | No | Yes | | CVE-2016-2403 | Symfony Authentication Bypass | critical | 9.8 | No | No | Yes | | CVE-2016-4423 | Symphony Denial of Service Via Overlong Usernames | high | 7.5 | No | No | Yes | | CVE-2016-1902 | Symfony Cryptographic Vulnerability | high | 7.5 | No | No | Yes | | CVE-2015-8125 | Symfony Vulnerable to Timing Attack | high | 7.5 | No | No | Yes | | CVE-2015-8124 | Symfony Session Fixation Vulnerability | low | 3.1 | No | No | Yes | | CVE-2013-5958 | Symfony Denial of Service Via Long Password Hashing | medium | 5.0 | No | No | Yes | | CVE-2012-6431 | Symfony Allows URI Restrictions Bypass Via Double-Encoded String | medium | 6.4 | No | No | Yes | ## Frequently asked questions ### How many CVEs does symfony symfony/security have? symfony symfony/security has 17 published CVE records since 2012. ### How many symfony symfony/security CVEs are in CISA KEV? None of symfony symfony/security's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for symfony symfony/security vulnerabilities? No symfony symfony/security CVEs currently have a tracked public exploit in this dataset. ### Which versions of symfony symfony/security are affected? 95 distinct symfony symfony/security versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in symfony symfony/security CVEs? symfony symfony/security's CVEs most often map to these CWE weakness types: CWE-287 (Improper Authentication), CWE-399 (Resource Management Errors), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-285 (Improper Authorization). ### How many critical symfony symfony/security vulnerabilities are there? symfony symfony/security has 3 critical and 7 high-severity CVEs. ### What is the average severity of symfony symfony/security CVEs? The average CVSS base score across symfony symfony/security's scored CVEs is 7.2. ## Other products from this vendor - [symfony](https://radicalnotion.ai/vendor/symfony/symfony) (115 CVEs) - [symfony/symfony](https://radicalnotion.ai/vendor/symfony/symfony-symfony) (96 CVEs) - [twig](https://radicalnotion.ai/vendor/symfony/twig) (25 CVEs) - [symfony/security-http](https://radicalnotion.ai/vendor/symfony/symfony-security-http) (19 CVEs) - [symfony/http-foundation](https://radicalnotion.ai/vendor/symfony/symfony-http-foundation) (14 CVEs) - [security-http](https://radicalnotion.ai/vendor/symfony/security-http) (11 CVEs) - [ux](https://radicalnotion.ai/vendor/symfony/ux) (10 CVEs) - [symfony/http-kernel](https://radicalnotion.ai/vendor/symfony/symfony-http-kernel) (8 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/symfony/symfony-security). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.