CVE-2021-32693
CVSS V2 Medium 6.5
CVSS V3 High 8.8
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the application, in such a situation, a user authenticated on a part of the application could be considered authenticated on the rest of the application. Starting in version 5.3.2, a patch ensures that the authenticated token is only available for the firewall that generates it.
Overview
- CVE ID
- CVE-2021-32693
- Assigner
- security-advisories@github.com
- Vulnerability Status
- Analyzed
- Published Version
- 2021-06-17T23:15:07
- Last Modified Date
- 2021-06-24T19:00:31
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* | 1 | OR | 5.3.0 | 5.3.2 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:S/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- SINGLE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 6.5
- Severity
- MEDIUM
- Exploitability Score
- 8
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 8.8
- Base Severity
- HIGH
- Exploitability Score
- 2.8
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728 | Patch Third Party Advisory |
| https://github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrq | Patch Third Party Advisory |
| https://github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129 | Patch Third Party Advisory |
| https://symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-one | Patch Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-32693 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32693 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 07:09:56 | Added to TrackCVE | |||
| 2022-12-05 04:36:56 | 2021-06-17T23:15Z | 2021-06-17T23:15:07 | CVE Published Date | updated |
| 2022-12-05 04:36:56 | 2021-06-24T19:00:31 | CVE Modified Date | updated | |
| 2022-12-05 04:36:56 | Analyzed | Vulnerability Status | updated |