PT-2015-5706 · Symfony · Symfony

CVE-2015-2309 · Publicado 2015-01-01 · Atualizado 2025-09-24

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Symfony HttpFoundation component versions 2.0.X through 2.6.X

Description The issue affects the SymfonyComponentHttpFoundationRequest class, which has a mechanism to ensure it does not trust HTTP header values coming from a "non-trusted" client. However, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request, allowing a man-in-the-middle attack between the latest trusted proxy and the web server. The impacted methods are getPort(), isSecure(), getHost(), and getClientIps().

Recommendations For Symfony 2.3.X, update to version 2.3.27 to resolve the issue. For Symfony 2.5.X, update to version 2.5.11 to resolve the issue. For Symfony 2.6.X, update to version 2.6.6 to resolve the issue. For Symfony 2.0, 2.1, 2.2, and 2.4, no fixes are provided as they are not maintained anymore.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-2309

GHSA-P684-F7FH-JV2J

Produtos afetados

Symfony

Referências · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2015-2309.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-2309.yaml · Exploit
• https://github.com/symfony/symfony/commit/6c73f0ce9302a0091bbfbb96f317e400ce16ef84 · Nota
• https://github.com/symfony/symfony/pull/14166 · Nota
• https://cve.org/CVERecord?id=CVE-2015-2309 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2309 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-2309 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2309 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p684-f7fh-jv2j · Aviso do Fabricante
• https://symfony.com/cve-2015-2309 · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-2309 · Aviso do Fabricante