Authentication Bypass Affecting symfony/http-foundation package, versions >=2.3.0, <2.3.19 >=2.1.0, <2.2.0 >=2.4.0, <2.4.9 >=2.5.0, <2.5.4 >=2.2.0, <2.3.0 >=2.0.0, <2.1.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SYMFONYHTTPFOUNDATION-70179
- published 3 Sep 2014
- disclosed 3 Sep 2014
- credit Damien Tournoud
Introduced: 3 Sep 2014
CVE-2014-6061 Open this link in a new tabHow to fix?
Upgrade symfony/http-foundation to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.
Overview
Affected versions of symfony/http-foundation are vulnerable to Authentication Bypass.
When an application uses an HTTP basic or digest authentication, Symfony does not parse the Authorization header properly, which could be exploited in some server setups (no exploits have been demonstrated though.)
References
CVSS Scores
version 3.1