GCVE - cpe:2.3:a:sensiolabs:symfony:2.3.19:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sensiolabs:symfony:2.3.19:*:*:*:*:*:*:*

part: a version: 2.3.19 update: *

Vendor	Sensiolabs (`e4f7b9e1-5bf2-556d-92af-e3d3eaa00050`)
Product	Symfony (`ba667c32-f585-51a5-878f-6a88255d834f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:composer/symfony/symfony`	purl2cpe	2026-06-01 10:16:26.179665
`pkg:github/symfony/symfony`	purl2cpe	2026-06-01 10:16:26.179667

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-8125`	vulnerable	2026-06-08 05:07:03.232918	Details available Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component. Published: 2015-12-07T20:00:00.000Z Updated: 2024-08-06T08:13:31.682Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html http://www.debian.org/security/2015/dsa-3402 https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service http://www.securityfocus.com/bid/77692	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8124`	vulnerable	2026-06-08 05:07:03.215083	Details available Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id. Published: 2015-12-07T20:00:00.000Z Updated: 2024-08-06T08:13:31.834Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html http://www.securityfocus.com/archive/1/537183/100/0/threaded http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html http://www.debian.org/security/2015/dsa-3402 http://www.securityfocus.com/bid/77694	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-4050`	vulnerable	2026-06-08 05:06:39.109631	Details available FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment. Published: 2015-06-02T14:00:00.000Z Updated: 2024-08-06T06:04:03.032Z Open on db.gcve.eu Reference links http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html http://www.debian.org/security/2015/dsa-3276 http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2308`	vulnerable	2026-06-08 05:06:27.937452	Details available Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element. Published: 2015-06-24T10:00:00.000Z Updated: 2024-08-06T05:10:16.150Z Open on db.gcve.eu Reference links https://symfony.com/blog/cve-2015-2308-esi-code-injection http://jvndb.jvn.jp/jvndb/JVNDB-2015-000089 http://jvn.jp/en/jp/JVN19578958/index.html http://www.securityfocus.com/bid/75357	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.