Exposición de Symfony

Web frameworks
82
score de exposición
9704
sitios usan
0
en explotación
1
críticos
Análisis Vexday

O histórico de vulnerabilidades catalogadas para o framework Symfony soma 24 CVEs, sem registros de exploração ativa confirmada no catálogo CISA KEV e sem entradas de severidade crítica, o que posiciona a tecnologia abaixo da média geral do catálogo em termos de taxa de exploração. Ainda assim, merece atenção o fato de que a CVE mais perigosa atualmente identificada, CVE-2024-50340, apresenta um score EPSS de aproximadamente 0,63, indicando probabilidade relevante de exploração prática em curto prazo. O tipo de falha mais recorrente é CWE-287 (autenticação inadequada), padrão que costuma facilitar acesso não autorizado quando não mitigado adequadamente. Equipes responsáveis por ambientes baseados em Symfony devem priorizar a revisão dos mecanismos de autenticação e acompanhar ativamente a evolução do risco associado a CVE-2024-50340.

CVEs

53 resultados
CVE-2024-50340HIGHAbility to change environment from query in symfony/runtimeEPSS 63.4%CVE-2022-24894MEDIUMSymfony storing cookie headers in HttpCacheEPSS 4.0%CVE-2020-15094HIGHRCE in SymfonyEPSS 3.0%CVE-2021-21424MEDIUMPrevent user enumeration using Guard or the new Authenticator-based SecurityEPSS 1.7%CVE-2021-32693MEDIUMAuthentication granted with multiple firewallsEPSS 1.4%CVE-2021-41270MEDIUMCSV Injection in SymfonyEPSS 1.4%CVE-2025-64500HIGHSymfony's incorrect parsing of PATH_INFO can lead to limited authorization bypassEPSS 1.3%CVE-2020-5255LOWPrevent cache poisoning via a Response Content-Type headerEPSS 1.3%CVE-2021-41268MEDIUMCookie persistence in SymfonyEPSS 1.3%CVE-2021-41267MEDIUMWebcache Poisoning in SymfonyEPSS 1.2%CVE-2020-5274MEDIUMExceptions displayed in non-debug configurations in SymfonyEPSS 1.2%CVE-2020-5275HIGHFirewall configured with unanimous strategy was not actually unanimous in symfony/security-httpEPSS 1.1%CVE-2026-45304HIGHSymfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")EPSS 0.8%CVE-2026-45305HIGHSymfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() RegexEPSS 0.8%CVE-2022-24895MEDIUMSymfony vulnerable to Session Fixation of CSRF tokensEPSS 0.8%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.7%CVE-2023-46733MEDIUMSymfony possible session fixation vulnerabilityEPSS 0.7%CVE-2023-46734MEDIUMSymfony potential Cross-site Scripting vulnerabilities in CodeExtension filtersEPSS 0.7%CVE-2024-51996HIGHSymphony has an Authentication Bypass via RememberMeEPSS 0.6%CVE-2026-45067MEDIUMSymfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\AddressEPSS 0.6%