CVE-2017-11365: Symfony Incorrect Access Control
Summary
CVE-2017-11365: Symfony Incorrect Access Control. Affects symfony/security-core across 4 version ranges.
>= 2.7.30, < 2.7.32
>= 2.8.23, < 2.8.25
>= 3.2.10, < 3.2.12
>= 3.3.3, < 3.3.5
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Symfony is a popular PHP framework used for developing web applications. It provides a set of reusable components and tools for building robust and scalable applications. The vulnerability in question, Incorrect Access Control, affects Symfony versions 2.7.30, 2.8.23, 3.2.10, and 3.3.3. This vulnerability specifically impacts the Password validator component of Symfony.
Vulnerability Detail
The Incorrect Access Control vulnerability allows remote attackers to bypass access controls and potentially gain unauthorized access to sensitive resources. This can lead to various security breaches, such as unauthorized data access, privilege escalation, or remote code execution. The vulnerability arises from a flaw in the access control mechanism implemented in Symfony's Password validator component.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.30, < 2.7.322.7.32composer require symfony/security-core:2.7.32 -
>= 2.8.23, < 2.8.252.8.25composer require symfony/security-core:2.8.25 -
>= 3.2.10, < 3.2.123.2.12composer require symfony/security-core:3.2.12 -
>= 3.3.3, < 3.3.53.3.5composer require symfony/security-core:3.3.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix provided by Symfony to mitigate the risk of exploitation.
Conclusion
The Incorrect Access Control vulnerability in Symfony can have severe consequences, including unauthorized access to sensitive resources. It is crucial to promptly apply the official fix provided by Symfony to mitigate the risk of exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/security-core →
FAQ
Symfony is a PHP framework used for building web applications. It provides a set of reusable components and tools that simplify the development process.
The vulnerability allows remote attackers to bypass access controls and potentially gain unauthorized access to sensitive resources. This can lead to various security breaches, such as unauthorized data access, privilege escalation, or remote code execution.
Symfony versions 2.7.30, 2.8.23, 3.2.10, and 3.3.3 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to apply the official fix provided by Symfony to mitigate the risk of exploitation.
To fix this vulnerability, it is recommended to upgrade Symfony to the latest version available. The Symfony project provides patches and updates to address security issues. Developers should update their Symfony installation to a version that includes the fix for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/security-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
