PT-2024-10558 · Symfony · Symfony Httpfoundation

Published 2024-05-30 · Updated 2024-05-30 · CVE-2014-6061

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Symfony HttpFoundation component versions 2.0.X through 2.5.X

Description The issue arises when an application uses HTTP basic or digest authentication, and the Authorization header is not parsed properly by Symfony, potentially allowing exploitation in certain server setups. No exploits have been demonstrated.

Recommendations For versions 2.3.X, update to version 2.3.19 or later. For versions 2.4.X, update to version 2.4.9 or later. For versions 2.5.X, update to version 2.5.4 or later. For versions 2.0.X, 2.1.X, and 2.2.X, no fixes are provided as these versions are no longer maintained. As a temporary workaround, consider restricting the use of HTTP basic or digest authentication until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-6061

GHSA-H7V2-2QWG-H829

Affected Products

Symfony Httpfoundation

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-6061.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2014-6061.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-h7v2-2qwg-h829 · Vendor Advisory
• https://github.com/symfony/symfony/pull/11829 · Note
• https://github.com/symfony/symfony/commit/3b4046e89467dc1fb5e079e377c2cfd4c239f904 · Note
• https://symfony.com/cve-2014-6061 · Note