Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

symfony/framework-bundle

Provides a tight integration between Symfony components and the Symfony full-stack framework

Composer latest 8.1.7 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

8.1.7

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

High

3 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

3
GHSA-wfv7-5x33-v22h high

Code injection in the way Symfony implements translation caching in FrameworkBundle

Affected range

ECOSYSTEM: introduced 2.0.0; fixed 2.3.18ECOSYSTEM: introduced 2.4.0; fixed 2.4.8ECOSYSTEM: introduced 2.5.0; fixed 2.5.2>=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.3.18|>=2.4.0,<2.4.8|>=2.5.0,<2.5.2

Fixed versions: 2.3.18, 2.4.8, 2.5.2

CVE-2014-4931 Source ↗Source ↗
GHSA-vvmr-8829-6whx high

CSRF token missing in Symfony

Affected range

ECOSYSTEM: introduced 5.3.14; fixed 5.3.15ECOSYSTEM: introduced 5.4.3; fixed 5.4.4ECOSYSTEM: introduced 6.0.3; fixed 6.0.4>=5.3.14,<5.3.15|>=5.4.3,<5.4.4|>=6.0.3,<6.0.4

Fixed versions: 5.3.15, 5.4.4, 6.0.4

CVE-2022-23601 Source ↗Source ↗
GHSA-g996-q5r8-w7g2 moderate

Symfony Cross-site Scripting (XSS) vulnerability

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.51ECOSYSTEM: introduced 2.8.0; fixed 2.8.50ECOSYSTEM: introduced 3.0.0; fixed 3.4.26ECOSYSTEM: introduced 4.0.0; fixed 4.1.12ECOSYSTEM: introduced 4.2.0; fixed 4.2.7

Fixed versions: 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7

CVE-2019-10909 Source ↗Source ↗