CVE-2020-5274
mediumpriority · track · 22EPSS 0.012 · 68 %ileEUUSEPSS · scored 2026-10-27
In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (10)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-m884-279h-32v2Exceptions displayed in non-debug configurations in Symfony2020-03-30ghsa · osvUS
Description ----------- When `ErrorHandler` renders an exception HTML page, it uses un-escaped properties from the related Exception class to render the stacktrace. The security issue comes from the fact that the stacktraces were also displayed in non-`debug` environments. Resolution ---------- The `ErrorHandler` class now escapes all properties coming from the related Exception, and the stacktrace is not displayed anymore in non-`debug` environments. The patches for this issue are available [here](https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5ad) and [here](https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45db) for branch 4.4. Credits ------- I would like to thank Luka Sikic for reporting & Yonel Ceruto and Jérémy Derussé for fixing the issue.
- BIT-symfony-2020-52742024-03-06vendor · osvUS
In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45dbcnnvd
- https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5adcnnvd
- https://github.com/symfony/symfony/security/advisories/GHSA-m884-279h-32v2cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-5274cnnvd
- https://vigilance.fr/vulnerability/Symfony-information-disclosure-via-ErrorHandler-31910cnnvd
- https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45dbenisa_euvd
- https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5adenisa_euvd
- https://github.com/symfony/symfony/security/advisories/GHSA-m884-279h-32v2enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan