CVE-2015-2309
mediumpriority · track · 0US中文Shown in its original language — a full translation is planned for a future version.
Sensio Labs Symfony是法国Sensio Labs公司的一套免费的、基于MVC架构的PHP开发框架。该框架提供常用的功能组件及工具，可用于快速创建复杂的WEB程序。 Sensio Labs Symfony中存在安全绕过漏洞，该漏洞源于程序处理HTTP请求时没有正确验证与可信代理连接的客户端的远程地址。攻击者可利用该漏洞实施中间人攻击，调用受限制的方法。以下版本受到影响：Symfony 2.0.X版本，2.1.X版本，2.2.X版本，2.3.X版本，2.4.X版本，2.5.X版本，2.6.X版本。
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-p684-f7fh-jv2jSymfony has unsafe methods in the Request class2024-05-30ghsa · osvUS
All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they are not maintained anymore. ### Description The Symfony\Component\HttpFoundation\Request class provides a mechanism that ensures it does not trust HTTP header values coming from a "non-trusted" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middle attack between the latest trusted proxy and the web server. The following methods are impacted: getPort(), isSecure(), and getHost(), and getClientIps(). ### Resolution All impacted methods now check that the remote address is trusted, which fixes the issue. The patch for this issue is available [here](https://github.com/symfony/symfony/pull/14166).
also known as (1)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (2) cnnvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan