CVE Daily

CVE-2012-6431

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently withi...

Medium CVSS 6.4

Overview

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

CWE: CWE-264 Published: 2012-12-27T11:47:01.790
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 6.4 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags