CVE-2014-5245 — Sensitive Information Exposure in Http-kernel

CWE-200 — Sensitive Information Exposure2 documents2 sources
Severity
—HIGH
No vector
EPSS
No EPSS data
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Symfony Http-kernelSymfony
Timeline
PublishedMay 30

Description

Symfony allows direct access of ESI URLs behind a trusted proxy All 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpKernel component are affected by this security issue. Your application is vulnerable only if the ESI feature is enabled and there is a proxy in front of the web application. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.2 as it is not maintained anymore. Description When you enable the ESI feature and when…

Affected Packages2 packages

▶Packagistsymfony/symfony2.0.0 — 2.3.19+2
▶Packagistsymfony/http-kernel2.0.0 — 2.3.19+2

🔴Vulnerability Details

2
OSV
Symfony allows direct access of ESI URLs behind a trusted proxy↗2024-05-30
▶
GHSA
Symfony allows direct access of ESI URLs behind a trusted proxy↗2024-05-30
▶
CVE-2014-5245 — Sensitive Information Exposure | cvebase