GitHub Advisoryadvisory · Packagist

GHSA-q87v-q8fw-gmj5 Symfony Incorrect Access Control

CRITICAL Published 2022-05-24 Modified 2024-02-08 Official page ↗
Aliases
CVE-2017-11365
Ecosystem
Packagist
Packages
symfony/security-core, symfony/security, symfony/symfony
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2023-07-25

Affected packages

• Packagist symfony/security-core: >= 2.7.30, < 2.7.32 → fixed in 2.7.32 • Packagist symfony/security-core: >= 2.8.23, < 2.8.25 → fixed in 2.8.25 • Packagist symfony/security-core: >= 3.2.10, < 3.2.12 → fixed in 3.2.12 • Packagist symfony/security-core: >= 3.3.3, < 3.3.5 → fixed in 3.3.5 • Packagist symfony/security: >= 2.7.30, < 2.7.32 → fixed in 2.7.32 • Packagist symfony/security: >= 2.8.23, < 2.8.25 → fixed in 2.8.25 • Packagist symfony/security: >= 3.2.10, < 3.2.12 → fixed in 3.2.12 • Packagist symfony/security: >= 3.3.3, < 3.3.5 → fixed in 3.3.5 • Packagist symfony/symfony: >= 2.7.30, < 2.7.32 → fixed in 2.7.32 • Packagist symfony/symfony: >= 2.8.23, < 2.8.25 → fixed in 2.8.25 • Packagist symfony/symfony: >= 3.2.10, < 3.2.12 → fixed in 3.2.12 • Packagist symfony/symfony: >= 3.3.3, < 3.3.5 → fixed in 3.3.5

Description

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.

Related

Alias · CVE (1)

  • CVE-2017-11365 Certain Symfony products are affected by: Incorrect Access Control. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References