CVE-2015-2308
published 2015-06-24CVE-2015-2308: Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows…
PriorityP339medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
1.36%
68.8th percentile
Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.
Affected
86 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | symfony | < symfony 2.3.21+dfsg-4 (bookworm) | symfony 2.3.21+dfsg-4 (bookworm) |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Symfony Vulnerable to PHP Eval Injection
osv·2022-05-17
CVE-2015-2308 [MEDIUM] Symfony Vulnerable to PHP Eval Injection
Symfony Vulnerable to PHP Eval Injection
Applications with ESI support (and SSI support as of Symfony 2.6) enabled and using the Symfony built-in reverse proxy (the `Symfony\Component\HttpKernel\HttpCache class) are vulnerable to PHP code injection; a malicious user can inject PHP code that will be executed by the server.
HttpCache uses eval() to execute files in its cache when they contain ESI tags (and only when ESI is enabled). The vulnerability comes from the fact that PHP allows contents of tags to be executed (and this kind of PHP tags is always available regardless of the configuration), but there were not escaped before the evaluation.
A possible exploit comes from websites also vulnerable to Cross-Site Scripting as an attacker can successfully conduct a PHP code injection attac
GHSA
Symfony Vulnerable to PHP Eval Injection
ghsa·2022-05-17
CVE-2015-2308 [MEDIUM] CWE-94 Symfony Vulnerable to PHP Eval Injection
Symfony Vulnerable to PHP Eval Injection
Applications with ESI support (and SSI support as of Symfony 2.6) enabled and using the Symfony built-in reverse proxy (the `Symfony\Component\HttpKernel\HttpCache class) are vulnerable to PHP code injection; a malicious user can inject PHP code that will be executed by the server.
HttpCache uses eval() to execute files in its cache when they contain ESI tags (and only when ESI is enabled). The vulnerability comes from the fact that PHP allows contents of tags to be executed (and this kind of PHP tags is always available regardless of the configuration), but there were not escaped before the evaluation.
A possible exploit comes from websites also vulnerable to Cross-Site Scripting as an attacker can successfully conduct a PHP code injection attac
OSV
CVE-2015-2308: Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2
osv·2015-06-24·CVSS 6.8
CVE-2015-2308 [MEDIUM] CVE-2015-2308: Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2
Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.
Debian
CVE-2015-2308: symfony - Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x...
vendor_debian·2015·CVSS 6.8
CVE-2015-2308 [MEDIUM] CVE-2015-2308: symfony - Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x...
Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.
Scope: local
bookworm: resolved (fixed in 2.3.21+dfsg-4)
bullseye: resolved (fixed in 2.3.21+dfsg-4)
forky: resolved (fixed in 2.3.21+dfsg-4)
sid: resolved (fixed in 2.3.21+dfsg-4)
trixie: resolved (fixed in 2.3.21+dfsg-4)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://jvn.jp/en/jp/JVN19578958/index.htmlhttp://jvndb.jvn.jp/jvndb/JVNDB-2015-000089http://www.securityfocus.com/bid/75357https://symfony.com/blog/cve-2015-2308-esi-code-injectionhttp://jvn.jp/en/jp/JVN19578958/index.htmlhttp://jvndb.jvn.jp/jvndb/JVNDB-2015-000089http://www.securityfocus.com/bid/75357https://symfony.com/blog/cve-2015-2308-esi-code-injection
2015-06-24
Published