CVE-2024-50342 — Sensitive Information Exposure in Symfony

CWE-200 — Sensitive Information Exposure7 documents6 sources
Severity
4.3MEDIUMNVD
CNA3.1
EPSS
0.5%
top 33.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
SymfonySensiolabs HttpclientSymfony Http-client
Timeline
PublishedNov 6
Latest updateFeb 18

Description

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workaroun…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶Packagistsymfony/http-client4.3.0 — 5.4.47+2
▶NVDsensiolabs/httpclient6.0.0 — 6.4.14+2
▶CVEListV5symfony/symfony< 5.4.46+2
▶Packagistsymfony/symfony4.3.0 — 5.4.47+2
▶Debiansymfony/symfony< 5.4.23+dfsg-1+deb12u3+2

Patches

Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient↗2024-11-06
▶
OSV
Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient↗2024-11-06
▶
OSV
CVE-2024-50342: symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously↗2024-11-06
▶
CVEList
Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client↗2024-11-06
▶

📋Vendor Advisories

2
Ubuntu
Symfony vulnerabilities↗2025-02-18
▶
Debian
CVE-2024-50342: symfony - symfony/http-client is a module for the Symphony PHP framework which provides po...↗2024
▶
CVE-2024-50342 — Sensitive Information Exposure | cvebase