CVE-2021-32693

published 2021-06-17

CVE-2021-32693: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in…

Priority P3 51 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the application, in such a situation, a user authenticated on a part of the application could be considered authenticated on the rest of the application. Starting in version 5.3.2, a patch ensures that the authenticated token is only available for the firewall that generates it.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	symfony	—	—
sensiolabs	symfony	>= 5.3.0 < 5.3.2	5.3.2
symfony	security-http	>= 5.3.0 < 5.3.2	5.3.2
symfony	symfony	—	—
symfony	symfony	>= 5.3.0 < 5.3.2	5.3.2

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

vendor_debian 6.8 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287