Information Exposure Affecting symfony/symfony package, versions >=2.3.0, <2.3.19 >=2.1.0, <2.2.0 >=2.4.0, <2.4.9 >=2.5.0, <2.5.4 >=2.2.0, <2.3.0 <2.1.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SYMFONYSYMFONY-70212
- published 3 Sep 2014
- disclosed 3 Sep 2014
- credit Cédric Nirousset, Trent Steel, Christophe Coevoet
Introduced: 3 Sep 2014
CVE-2014-5245 Open this link in a new tabHow to fix?
Upgrade symfony/symfony to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.
Overview
symfony/symfony is a PHP framework for web applications and a set of reusable PHP components.
Affected versions of this package are vulnerable to Information Exposure. The package can not distinguish between ESI requests done on behalf of the client by Varnish and faked fragment requests coming directly from the client.
References
CVSS Scores
version 3.1