PT-2015-5706 · Symfony · Symfony

Published 2015-01-01 · Updated 2025-09-24 · CVE-2015-2309

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Symfony HttpFoundation component versions 2.0.X through 2.6.X

Description The issue affects the SymfonyComponentHttpFoundationRequest class, which has a mechanism to ensure it does not trust HTTP header values coming from a "non-trusted" client. However, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request, allowing a man-in-the-middle attack between the latest trusted proxy and the web server. The impacted methods are getPort(), isSecure(), getHost(), and getClientIps().

Recommendations For Symfony 2.3.X, update to version 2.3.27 to resolve the issue. For Symfony 2.5.X, update to version 2.5.11 to resolve the issue. For Symfony 2.6.X, update to version 2.6.6 to resolve the issue. For Symfony 2.0, 2.1, 2.2, and 2.4, no fixes are provided as they are not maintained anymore.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-2309

GHSA-P684-F7FH-JV2J

Affected Products

Symfony

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2015-2309.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-2309.yaml · Exploit
• https://cve.org/CVERecord?id=CVE-2015-2309 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2309 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-2309 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2309 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p684-f7fh-jv2j · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-2309 · Vendor Advisory
• https://github.com/symfony/symfony/commit/6c73f0ce9302a0091bbfbb96f317e400ce16ef84 · Note
• https://github.com/symfony/symfony/pull/14166 · Note
• https://symfony.com/cve-2015-2309 · Note