Log in Start free

Vulnerability · Published Mar 30, 2020 · Assigned by GitHub_M

CVE-2020-5275Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http

High 7.6

In plain English

A high-severity security flaw in symfony from symfony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)1.1%top 33.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7 and 5.0.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12symfony4.4.8-1DEBIAN-CVE-2020-5275
Debian:13symfony4.4.8-1DEBIAN-CVE-2020-5275
Debian:14symfony4.4.8-1DEBIAN-CVE-2020-5275
Packagistsymfony/security4.4.7GHSA-g4m9-5hpf-hx72
Packagistsymfony/security5.0.7GHSA-g4m9-5hpf-hx72
Packagistsymfony/security-http5.0.7GHSA-g4m9-5hpf-hx72
Packagistsymfony/security-http4.4.7GHSA-g4m9-5hpf-hx72
Packagistsymfony/symfony5.0.7GHSA-g4m9-5hpf-hx72
Packagistsymfony/symfony4.4.7GHSA-g4m9-5hpf-hx72

Affected products (as reported)

VendorProductVersions
symfony symfony >= 4.4.0, < 4.4.7>= 5.0.0, < 5.0.7

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

References