PT-2020-18365 · Symfony · Symfony Security Http

Chalasr · Published 2020-03-30 · Updated 2024-03-06 · CVE-2020-5275

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions symfony/security-http versions 4.4.0 through 4.4.6 symfony/security-http versions 5.0.0 through 5.0.6

Description The issue arises when a Firewall checks access control rules using the unanimous strategy. In affected versions, the Firewall iterates over each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on an attribute. This prevents the check of next attributes that should have been taken into account in the unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy to be applied on each attribute.

Recommendations For symfony/security-http versions 4.4.0 through 4.4.6, update to version 4.4.7 to resolve the issue. For symfony/security-http versions 5.0.0 through 5.0.6, update to version 5.0.7 to resolve the issue.

Exploit

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

BIT-SYMFONY-2020-5275

CVE-2020-5275

GHSA-G4M9-5HPF-HX72

Affected Products

Symfony Security Http

References · 15

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2020-5275.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2020-5275.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2020-5275.yaml · Exploit
• https://github.com/symfony/symfony/commit/c935e4a3fba6cc2ab463a6ca382858068d63cebf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-5275 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-5275 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ · Vendor Advisory
• https://osv.dev/vulnerability/BIT-symfony-2020-5275 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4m9-5hpf-hx72 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-5275 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5275 · Vendor Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-g4m9-5hpf-hx72 · Note
• https://symfony.com/cve-2020-5275 · Note
• https://t.me/cvenotify/2266 · Telegram Post