| Package | Affected versions | Patched versions |
|---|---|---|
| symfony/http-foundation | ≥ 2.0.0, < 2.0.19 | 2.0.19 |
| symfony/routing | ≥ 2.0.0, < 2.0.19 | 2.0.19 |
| symfony/security | ≥ 2.0.0, < 2.0.19 | 2.0.19 |
| symfony/symfony | ≥ 2.0.0, < 2.0.19 | 2.0.19 |
| symfony | = 2.0.0= 2.0.1= 2.0.10= 2.0.11= 2.0.12= 2.0.13= 2.0.14= 2.0.15= 2.0.16= 2.0.17= 2.0.18= 2.0.19= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.0.7= 2.0.8= 2.0.9 |
On the Symfony 2.0.x version, there's a security issue that allows access to routes protected by a firewall even when the user is not logged in.
Both the Routing component and the Security component uses the path returned by getPathInfo() to match a Request. The getPathInfo() returns a decoded path, but the Routing component (Symfony\Component\Routing\Matcher\UrlMatcher) decodes the path a second time; whereas the Security component, Symfony\Component\HttpFoundation\RequestMatcher, does not.
This difference causes Symfony 2.0 to be vulnerable to double encoding attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free