Security Http
Approved changes feed: RSS · Atom
cpe:2.3:a:symfony:security-http:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Symfony (88011d02-04e0-53e8-bc79-472f99951c29) |
|---|---|
| Product | Security Http (3983c641-21d0-5ca7-ae63-dd56cc6ba051) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-48489 |
vulnerable | 2026-07-29 00:55:01.358428 |
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Published: 2026-07-14T19:14:12.233Z
Updated: 2026-07-16T14:40:10.013Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45075 |
vulnerable | 2026-07-29 00:52:15.064175 |
Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.
Published: 2026-07-14T18:40:37.287Z
Updated: 2026-07-16T14:38:19.284Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45074 |
vulnerable | 2026-07-29 00:52:15.061530 |
Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.
Published: 2026-07-14T17:49:24.895Z
Updated: 2026-07-14T18:24:34.062Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.