BIT-symfony-2020-5275

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/symfony/BIT-symfony-2020-5275.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-symfony-2020-5275
Aliases
Published
2024-03-06T11:08:26.477Z
Modified
2024-03-06T11:25:28.861Z
Summary
[none]
Details

In symfony/security-http before versions 4.4.7 and 5.0.7, when a Firewall checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7 and 5.0.7.

Database specific
{
    "cpes": [
        "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / symfony

Package

Name
symfony
Purl
pkg:bitnami/symfony

Severity

  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
4.4.0
Fixed
4.4.7
Introduced
5.0.0
Fixed
5.0.7