PT-2012-6277 · Symfony · Symfony

Victor Berchet · Publicado 2012-12-27 · Atualizado 2022-05-17 · CVE-2012-6432

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symfony versions 2.0.x through 2.0.20 Symfony versions 2.1.x through 2.1.5 Symfony version 2.2-dev

Description The issue allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /api/ internal endpoint, specifically when the internal routes configuration is enabled.

Recommendations For Symfony versions 2.0.x through 2.0.20, update to version 2.0.20 or later. For Symfony versions 2.1.x through 2.1.5, update to version 2.1.5 or later. For Symfony version 2.2-dev, consider disabling the internal routes configuration until a patch is available.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

CWE-264

Identificadores relacionados

CVE-2012-6432

GHSA-89CP-FVCC-HXH7

Produtos afetados

Symfony

Referências · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2012-6432.yaml · Exploit
• https://github.com/symfony/symfony · Nota
• https://osv.dev/vulnerability/GHSA-89cp-fvcc-hxh7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-6432 · Nota de Segurança
• http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released · Aviso do Fabricante
• https://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released · Nota