Skip to content
OpenAdvisories
Medium CVE-2012-6431 EUVD-2022-3093GHSA-83c3-qx27-2rwr

Symfony Allows URI Restrictions Bypass Via Double-Encoded String

Published Dec 27, 2012 · Updated Sep 17, 2024 · Assigned by mitre

Package: symfony/http-foundation Package: symfony/routing Package: symfony/security Package: symfony/symfony Ecosystem: Packagist

Description

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist symfony/http-foundation >= 2.0.0, < 2.0.19 2.0.19 GHSA-83c3-qx27-2rwr
Packagist symfony/routing >= 2.0.0, < 2.0.19 2.0.19 GHSA-83c3-qx27-2rwr
Packagist symfony/security >= 2.0.0, < 2.0.19 2.0.19 GHSA-83c3-qx27-2rwr
Packagist symfony/symfony >= 2.0.0, < 2.0.19 2.0.19 GHSA-83c3-qx27-2rwr

References