Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

symfony/security

Provides a complete security system for your web application

Composer latest 4.4.50 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

4.4.50

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

Critical

17 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

17
GHSA-35c5-28pg-2qg4 critical

Symfony Authentication Bypass

Affected range

ECOSYSTEM: introduced 2.8.0; fixed 2.8.37ECOSYSTEM: introduced 3.0.0; fixed 3.3.17ECOSYSTEM: introduced 3.4.0; fixed 3.4.7ECOSYSTEM: introduced 4.0.0; fixed 4.0.7>=2.8.0,<2.8.37|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.3.17|>=3.4.0,<3.4.7|>=4.0.0,<4.0.7

Fixed versions: 2.8.37, 3.3.17, 3.4.7, 4.0.7

CVE-2018-11407 Source ↗Source ↗
GHSA-wvj5-r78r-hhfq critical

Symfony Authentication Bypass

Affected range

ECOSYSTEM: introduced 2.8.0; fixed 2.8.6ECOSYSTEM: introduced 3.0.0; fixed 3.0.6>=2.8.0,<2.8.6|>=3.0.0,<3.0.6

Fixed versions: 2.8.6, 3.0.6

CVE-2016-2403 Source ↗Source ↗
GHSA-q87v-q8fw-gmj5 critical

Symfony Incorrect Access Control

Affected range

ECOSYSTEM: introduced 2.7.30; fixed 2.7.32ECOSYSTEM: introduced 2.8.23; fixed 2.8.25ECOSYSTEM: introduced 3.2.10; fixed 3.2.12ECOSYSTEM: introduced 3.3.3; fixed 3.3.5>=2.7.30,<2.7.32|>=2.8.23,<2.8.25|>=3.2.10,<3.2.12|>=3.3.3,<3.3.5

Fixed versions: 2.7.32, 2.8.25, 3.2.12, 3.3.5

CVE-2017-11365 Source ↗Source ↗
GHSA-g4m9-5hpf-hx72 high

Firewall configured with unanimous strategy was not actually unanimous in Symfony

Affected range

ECOSYSTEM: introduced 4.4.0; fixed 4.4.7ECOSYSTEM: introduced 5.0.0; fixed 5.0.7>=4.4.0,<4.4.7

Fixed versions: 4.4.7, 5.0.7

CVE-2020-5275 Source ↗Source ↗
GHSA-whgv-8cg3-7hcm high

Symphony Denial of Service Via Overlong Usernames

Affected range

ECOSYSTEM: introduced 2.3.0; fixed 2.3.41ECOSYSTEM: introduced 2.4.0; fixed 2.7.13ECOSYSTEM: introduced 2.8.0; fixed 2.8.6ECOSYSTEM: introduced 3.0.0; fixed 3.0.6>=2.3.0,<2.3.41|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.7.13|>=2.8.0,<2.8.6|>=3.0.0,<3.0.6

Fixed versions: 2.3.41, 2.7.13, 2.8.6, 3.0.6

CVE-2016-4423 Source ↗Source ↗
GHSA-g97c-jfx6-xvxh high

Symfony Vulnerable to Timing Attack

Affected range

ECOSYSTEM: introduced 2.3.0; fixed 2.3.35ECOSYSTEM: introduced 2.4.0; fixed 2.6.12ECOSYSTEM: introduced 2.7.0; fixed 2.7.7>=2.3.0,<2.3.35|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.6.12|>=2.7.0,<2.7.7

Fixed versions: 2.3.35, 2.6.12, 2.7.7

CVE-2015-8125 Source ↗Source ↗
GHSA-jjx5-fq5g-8xpc high

Symfony Cryptographic Vulnerability

Affected range

ECOSYSTEM: introduced 2.3.0; fixed 2.3.37ECOSYSTEM: introduced 2.4.0; fixed 2.6.13ECOSYSTEM: introduced 2.7.0; fixed 2.7.9>=2.3.0,<2.3.37|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.6.13|>=2.7.0,<2.7.9

Fixed versions: 2.3.37, 2.6.13, 2.7.9

CVE-2016-1902 Source ↗Source ↗
GHSA-g4g7-q726-v5hg high

Symfony CSRF Token Fixation

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.48ECOSYSTEM: introduced 2.8.0; fixed 2.8.41ECOSYSTEM: introduced 3.0.0; fixed 3.3.17ECOSYSTEM: introduced 3.4.0; fixed 3.4.11ECOSYSTEM: introduced 4.0.0; fixed 4.0.11

Fixed versions: 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11

CVE-2018-11406 Source ↗Source ↗
GHSA-g4rg-rw65-8hfg high

Symfony Session Fixation Vulnerability

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.48ECOSYSTEM: introduced 2.8.0; fixed 2.8.41ECOSYSTEM: introduced 3.0.0; fixed 3.3.17ECOSYSTEM: introduced 3.4.0; fixed 3.4.11ECOSYSTEM: introduced 4.0.0; fixed 4.0.11

Fixed versions: 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11

CVE-2018-11385 Source ↗Source ↗
GHSA-cchx-mfrc-fwqr high

Improper authentication in Symfony

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.51ECOSYSTEM: introduced 2.8.0; fixed 2.8.50ECOSYSTEM: introduced 3.0.0; fixed 3.4.26ECOSYSTEM: introduced 4.0.0; fixed 4.1.12ECOSYSTEM: introduced 4.2.0; fixed 4.2.7

Fixed versions: 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7

CVE-2019-10911 Source ↗Source ↗
GHSA-5pv8-ppvj-4h68 moderate

Prevent user enumeration using Guard or the new Authenticator-based Security

Affected range

ECOSYSTEM: introduced 5.0.0; fixed 5.2.8ECOSYSTEM: introduced 2.8.0; fixed 3.4.49ECOSYSTEM: introduced 4.0.0; fixed 4.4.24>=2.8.0,<3.0.0|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.4.0|>=3.4.0,<3.4.49|>=4.0.0,<4.1.0|>=4.1.0,<4.2.0|>=4.2.0,<4.3.0|>=4.3.0,<4.4.0|>=4.4.0,<4.4.24

Fixed versions: 5.2.8, 3.4.49, 4.4.24

CVE-2021-21424 Source ↗Source ↗
GHSA-cr49-fx2v-9p57 moderate

Symfony Denial of Service Via Long Password Hashing

Affected range

ECOSYSTEM: introduced 2.0.0; fixed 2.0.25ECOSYSTEM: introduced 2.1.0; fixed 2.1.13ECOSYSTEM: introduced 2.2.0; fixed 2.2.9ECOSYSTEM: introduced 2.3.0; fixed 2.3.6>=2.0.0,<2.0.25|>=2.1.0,<2.1.13|>=2.2.0,<2.2.9|>=2.3.0,<2.3.6

Fixed versions: 2.0.25, 2.1.13, 2.2.9, 2.3.6

CVE-2013-5958 Source ↗Source ↗
GHSA-89r2-5g34-2g47 moderate

Symfony Open Redirect

Affected range

ECOSYSTEM: introduced 2.7.38; fixed 2.7.50ECOSYSTEM: introduced 2.8.0; fixed 2.8.49ECOSYSTEM: introduced 3.0.0; fixed 3.4.19ECOSYSTEM: introduced 4.0.0; fixed 4.0.15ECOSYSTEM: introduced 4.1.0; fixed 4.1.9

Fixed versions: 2.7.50, 2.8.49, 3.4.19, 4.0.15, 4.1.9, 4.2.1

CVE-2018-19790 Source ↗Source ↗
GHSA-r7p7-qr7p-2rrf moderate

Symfony Open Redirect

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.38ECOSYSTEM: introduced 2.8.0; fixed 2.8.31ECOSYSTEM: introduced 3.2.0; fixed 3.2.14ECOSYSTEM: introduced 3.3.0; fixed 3.3.13>=2.7.0,<2.7.38|>=2.8.0,<2.8.31|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.2.14|>=3.3.0,<3.3.13

Fixed versions: 2.7.38, 2.8.31, 3.2.14, 3.3.13

CVE-2017-16652 Source ↗Source ↗
GHSA-92x6-h2gr-8gxq moderate

Symfony CSRF Vulnerability

Affected range

ECOSYSTEM: introduced 2.7.0; fixed 2.7.38ECOSYSTEM: introduced 2.8.0; fixed 2.8.31ECOSYSTEM: introduced 3.0.0; fixed 3.2.14ECOSYSTEM: introduced 3.3.0; fixed 3.3.13>=2.7.0,<2.7.38|>=2.8.0,<2.8.31|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.2.14|>=3.3.0,<3.3.13

Fixed versions: 2.7.38, 2.8.31, 3.2.14, 3.3.13

CVE-2017-16653 Source ↗Source ↗
GHSA-j5jh-hpr4-h332 low

Symfony Session Fixation Vulnerability

Affected range

ECOSYSTEM: introduced 2.3.0; fixed 2.3.35ECOSYSTEM: introduced 2.4.0; fixed 2.6.12ECOSYSTEM: introduced 2.7.0; fixed 2.7.7>=2.3.0,<2.3.35|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.6.12|>=2.7.0,<2.7.7

Fixed versions: 2.3.35, 2.6.12, 2.7.7

CVE-2015-8124 Source ↗Source ↗