CVE-2020-5255 — Improper Interaction Between Multiple Correctly-Behaving Entities in Symfony
Severity
4.3MEDIUMNVD
CNA2.6
EPSS
0.4%
top 40.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 30
Latest updateApr 9
Description
In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4
Affected Packages5 packages
Patches
🔴Vulnerability Details
4📋Vendor Advisories
1Debian▶
CVE-2020-5255: symfony - In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a...↗2020