BIT-symfony-2020-5274

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/symfony/BIT-symfony-2020-5274.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-symfony-2020-5274

Aliases

Published

2024-03-06T11:08:37.408Z

Modified

2024-03-06T11:25:28.861Z

Summary

[none]

Details

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the ErrorHandler rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5

Database specific

{
    "cpes": [
        "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / symfony

Package

Name: symfony
Purl: pkg:bitnami/symfony

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

4.4.0

Fixed

4.4.4

Introduced

5.0.0

Fixed

5.0.4