Log in Start free

Vulnerability · Published May 13, 2021 · Assigned by GitHub_M

CVE-2021-21424Prevent user enumeration using Guard or the new Authenticator-based Security

Medium 5.3

In plain English

A medium-severity information exposure in symfony from symfony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.6%top 23.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12symfony4.4.19+dfsg-2DEBIAN-CVE-2021-21424
Debian:13symfony4.4.19+dfsg-2DEBIAN-CVE-2021-21424
Debian:14symfony4.4.19+dfsg-2DEBIAN-CVE-2021-21424
Packagistlexik/jwt-authentication-bundle2.10.7GHSA-5pv8-ppvj-4h68
Packagistlexik/jwt-authentication-bundle2.11.3GHSA-5pv8-ppvj-4h68
Packagistsymfony/maker-bundle1.31.1GHSA-5pv8-ppvj-4h68
Packagistsymfony/maker-bundle1.29.2GHSA-5pv8-ppvj-4h68
Packagistsymfony/security5.2.8GHSA-5pv8-ppvj-4h68
Packagistsymfony/security3.4.49GHSA-5pv8-ppvj-4h68
Packagistsymfony/security4.4.24GHSA-5pv8-ppvj-4h68
Packagistsymfony/security-core5.2.8GHSA-5pv8-ppvj-4h68
Packagistsymfony/security-core3.4.48GHSA-5pv8-ppvj-4h68
Packagistsymfony/security-core4.4.23GHSA-5pv8-ppvj-4h68
Packagistsymfony/security-guard5.2.8GHSA-5pv8-ppvj-4h68
Packagistsymfony/security-guard4.4.23GHSA-5pv8-ppvj-4h68
Packagistsymfony/security-guard3.4.48GHSA-5pv8-ppvj-4h68
Packagistsymfony/security-http5.2.8GHSA-5pv8-ppvj-4h68
Packagistsymfony/symfony5.2.9GHSA-5pv8-ppvj-4h68
Packagistsymfony/symfony3.4.49GHSA-5pv8-ppvj-4h68
Packagistsymfony/symfony4.4.24GHSA-5pv8-ppvj-4h68

Affected products (as reported)

VendorProductVersions
symfony symfony >= 2.8.0, < 3.4.48>= 4.0.0, < 4.4.23>= 5.0.0, < 5.2.8

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References