GCVE - cpe:2.3:a:sensiolabs:symfony:2.3.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sensiolabs:symfony:2.3.0:*:*:*:*:*:*:*

part: a version: 2.3.0 update: *

Vendor	Sensiolabs (`e4f7b9e1-5bf2-556d-92af-e3d3eaa00050`)
Product	Symfony (`ba667c32-f585-51a5-878f-6a88255d834f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:composer/symfony/symfony`	purl2cpe	2026-06-01 10:16:26.179625
`pkg:github/symfony/symfony`	purl2cpe	2026-06-01 10:16:26.179627

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-8125`	vulnerable	2026-06-08 05:07:03.232600	Details available Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component. Published: 2015-12-07T20:00:00.000Z Updated: 2024-08-06T08:13:31.682Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html http://www.debian.org/security/2015/dsa-3402 https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service http://www.securityfocus.com/bid/77692	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8124`	vulnerable	2026-06-08 05:07:03.205417	Details available Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id. Published: 2015-12-07T20:00:00.000Z Updated: 2024-08-06T08:13:31.834Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html http://www.securityfocus.com/archive/1/537183/100/0/threaded http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html http://www.debian.org/security/2015/dsa-3402 http://www.securityfocus.com/bid/77694	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-5958`	vulnerable	2026-06-08 05:04:54.867015	Details available The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750. Published: 2014-12-27T18:00:00.000Z Updated: 2024-08-06T17:29:42.718Z Open on db.gcve.eu Reference links http://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.