fkie_cve-2015-8125
Vulnerability from fkie_nvd
Published
2015-12-07 20:59
Modified
2025-04-12 10:46
Severity ?
Summary
Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "815710CF-CD6F-482A-AA49-F5DBD69CC78C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3614217B-B696-42F5-B700-154DC4A10362",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C9F16129-1132-410A-ABF5-07043E748EBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "86E24535-7FDC-4CD5-9CFF-BE3497D8142A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "39FAF963-1682-42ED-BE1C-04F4D67BC7E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6FAD933-5F1B-443C-833A-A7CA42B3E3AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "8315CC2E-1CA5-4877-9D8B-B1CE4C7E951A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "B65CCFF0-491A-49AC-89DC-1C5BB2E17C62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FBF037E9-7BCB-4B15-90E5-AC12B635FCFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.9:*:*:*:*:*:*:*",
"matchCriteriaId": "EB53AD64-7FA3-4B51-9BA4-1E6CEBC320B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E4299D5E-496C-455A-B6CB-1324D73E3BD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D52D4F61-92C2-44BA-8913-84C7B9625ECA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.12:*:*:*:*:*:*:*",
"matchCriteriaId": "AE64BBD6-A363-4331-B146-A15C299FA9B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.13:*:*:*:*:*:*:*",
"matchCriteriaId": "D3193871-9D22-489C-999C-047D126CB2A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.14:*:*:*:*:*:*:*",
"matchCriteriaId": "24349F39-72FD-4669-99EB-C53EA8D30703",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.15:*:*:*:*:*:*:*",
"matchCriteriaId": "7B4D9AFF-7F87-48CC-9C82-FC89F909A82C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.16:*:*:*:*:*:*:*",
"matchCriteriaId": "2E4C305C-1FDF-4D93-97F5-10D8C8ABE7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.17:*:*:*:*:*:*:*",
"matchCriteriaId": "A1770E39-DCE8-4F81-9E18-F606CEA1DA6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.18:*:*:*:*:*:*:*",
"matchCriteriaId": "104DB666-5608-4822-B4DA-A8BFB64856E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.19:*:*:*:*:*:*:*",
"matchCriteriaId": "5B629031-7AC2-4918-9FEC-C9D26EBB0161",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.20:*:*:*:*:*:*:*",
"matchCriteriaId": "397E0404-9856-45C1-B12D-058E84F3FA3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.21:*:*:*:*:*:*:*",
"matchCriteriaId": "A2EC987B-3C4D-4575-9BC8-9AFB794A20E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.22:*:*:*:*:*:*:*",
"matchCriteriaId": "DE17FB48-06AA-4275-9F3A-0CF008C9C86B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.23:*:*:*:*:*:*:*",
"matchCriteriaId": "39F81F64-CCF2-4CB1-9504-153267839BEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.24:*:*:*:*:*:*:*",
"matchCriteriaId": "7B1244EA-78F7-4501-9E42-52C77CE37963",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.25:*:*:*:*:*:*:*",
"matchCriteriaId": "CBCD0661-41FA-4F89-A1D8-C50BE232D36D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.26:*:*:*:*:*:*:*",
"matchCriteriaId": "1AC87263-68E3-4BF8-8ED7-C40CC2F8CE2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.27:*:*:*:*:*:*:*",
"matchCriteriaId": "51A66842-7423-49F0-9FD3-64B7DE146F30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.28:*:*:*:*:*:*:*",
"matchCriteriaId": "68CBB5C6-C707-43E9-AFC5-467E376D9218",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.29:*:*:*:*:*:*:*",
"matchCriteriaId": "53ADBD77-5D7C-4065-AF07-0D7D913EAB4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.30:*:*:*:*:*:*:*",
"matchCriteriaId": "60E9C327-F168-4591-AF45-86AC9695AFBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.31:*:*:*:*:*:*:*",
"matchCriteriaId": "44A428C5-7A39-4B17-850C-5A2BA7D207B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.32:*:*:*:*:*:*:*",
"matchCriteriaId": "D6EAA53F-6A62-4BD5-BB3D-B95885877067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.33:*:*:*:*:*:*:*",
"matchCriteriaId": "5C839442-0832-42C7-8D3C-C3BC75F96CC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.34:*:*:*:*:*:*:*",
"matchCriteriaId": "07CA4138-9897-44A5-BBCC-B5054D5F9EDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F13A190-1F97-4D7B-826A-E976934AE82B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "27770F28-584A-48E1-B885-6C6D17F546ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3D52659E-1F0D-4319-A986-9BA512995C62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C177DF32-F356-483C-82E5-8FCC68D89A74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D9461C-A049-48EC-BB3E-FD3212C82795",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0F7EF330-714D-42E4-A2CF-406B84F3945B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2D86A4FF-9BD2-4B3D-A2CE-E9200A4EC690",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "5D6667BA-5A82-480B-AD9B-0E4CD0188458",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7CFF0C34-4474-448B-8402-F9F7E6E1BA00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "3EA6C319-AE4B-419F-BCAD-57D8ACF83EA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "00E132C9-F809-4AD9-959B-FFA8CB92780D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "83BE3955-422A-4E81-9B81-4C2484E5C335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "ABCF4EF8-5251-46B4-9B53-44783CD82082",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A03AAA02-DB58-42C5-B4A6-C2608CDB7123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7DA4FA9-AED8-4CCB-85E4-6D0BF6776FC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "32021069-B447-40B2-BBF9-0D2CFDE8ECC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "38F01C2E-5A1B-441A-B58C-C450AA1C1410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "660AA98C-4E93-4D8B-A4EC-A94E24DCDB9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "388F9E94-C2C1-4010-97DA-B008E89D500F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component."
},
{
"lang": "es",
"value": "Symfony 2.3.x en versiones anteriores a 2.3.35, 2.6.x en versiones anteriores a 2.6.12 y 2.7.x en versiones anteriores a 2.7.7 podr\u00eda permitir a atacantes remotos tener un impacto no especificado a trav\u00e9s de un ataque de sincronizaci\u00f3n involucrando las clases (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices o (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener en la implementaci\u00f3n Symfony Security Component o la implementaci\u00f3n de (3) legacy CSRF de la clase Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider en el componente Symfony Form."
}
],
"id": "CVE-2015-8125",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-12-07T20:59:15.487",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3402"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/77692"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3402"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/77692"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…