PT-2020-18364 · Symfony · Symfony+1

Luka Sikic · Published 2020-03-30 · Updated 2024-03-06 · CVE-2020-5274

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 4.4.5 and 5.0.5 symfony/http-foundation versions prior to 4.4.5 and 5.0.5

Description The issue arises from the ErrorHandler rendering unescaped properties of the Exception class when displaying the stacktrace, which was also visible in non-debug configurations. This has been resolved by ensuring the ErrorHandler escapes all properties from the Exception and only displays the stacktrace in debug configurations.

Recommendations For Symfony versions prior to 4.4.5, update to version 4.4.5 or later. For Symfony versions prior to 5.0.5, update to version 5.0.5 or later. As a temporary workaround, consider configuring the environment to debug mode only when necessary to minimize the risk of exploitation.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BIT-SYMFONY-2020-5274

CVE-2020-5274

GHSA-M884-279H-32V2

Affected Products

Symfony

Symfony Httpfoundation

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2020-5274.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/error-handler/CVE-2020-5274.yaml · Exploit
• https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45db · Patch
• https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5ad · Patch
• https://osv.dev/vulnerability/CVE-2020-5274 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-symfony-2020-5274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5274 · Security Note
• https://osv.dev/vulnerability/GHSA-m884-279h-32v2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-5274 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-5274 · Vendor Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-m884-279h-32v2 · Note
• https://t.me/cvenotify/2265 · Telegram Post
• https://symfony.com/cve-2020-5274 · Note