GCVE - cpe:2.3:a:sensiolabs:symfony:2.3.10:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sensiolabs:symfony:2.3.10:*:*:*:*:*:*:*

part: a version: 2.3.10 update: *

Vendor	Sensiolabs (`e4f7b9e1-5bf2-556d-92af-e3d3eaa00050`)
Product	Symfony (`ba667c32-f585-51a5-878f-6a88255d834f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:composer/symfony/symfony`	purl2cpe	2026-06-01 10:16:26.179632
`pkg:github/symfony/symfony`	purl2cpe	2026-06-01 10:16:26.179634

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-8125`	vulnerable	2026-06-08 05:07:03.232777	Details available Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component. Published: 2015-12-07T20:00:00.000Z Updated: 2024-08-06T08:13:31.682Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html http://www.debian.org/security/2015/dsa-3402 https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service http://www.securityfocus.com/bid/77692	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8124`	vulnerable	2026-06-08 05:07:03.210593	Details available Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id. Published: 2015-12-07T20:00:00.000Z Updated: 2024-08-06T08:13:31.834Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html http://www.securityfocus.com/archive/1/537183/100/0/threaded http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html http://www.debian.org/security/2015/dsa-3402 http://www.securityfocus.com/bid/77694	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.