Skip to main content

Symfony CVE-2012-6432

MEDIUM
Permissions, Privileges, and Access Controls (CWE-264)
2012-12-27 cve@mitre.org
6.8
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:P
Attack Vector
Network
Attack Complexity
M
Confidentiality
P
Integrity
P
Availability
P

Lifecycle Timeline

1
CVE Published
Dec 27, 2012 - 11:47 cve.org
MEDIUM 6.8

DescriptionCVE.org

Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.

AnalysisAI

Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified under CWE-264. Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring. Affected products include: Sensiolabs Symfony. Version information: before 2.0.20.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2015-4050 MEDIUM POC
4.3 Jun 02

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.1

CVE-2019-10910 CRITICAL POC
9.8 May 16

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when servic

CVE-2025-64500 HIGH POC
7.3 Nov 12

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Rated high severity (C

CVE-2026-24739 MEDIUM POC
6.3 Jan 28

Symfony versions up to 5.4.51 contains a vulnerability that allows attackers to operations being performed on an uninten

CVE-2018-12040 MEDIUM POC
6.1 Jun 13

Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attacke

CVE-2016-2403 CRITICAL
9.8 Feb 07

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty p

CVE-2024-51736 CRITICAL
9.8 Nov 06

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. Rated critical sev

CVE-2019-18889 CRITICAL
9.8 Nov 21

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Rated critical s

CVE-2019-11325 CRITICAL
9.8 Nov 21

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. Rated critical severity (CVSS 9.8), this vulner

CVE-2019-10913 CRITICAL
9.8 May 16

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Method

CVE-2018-11407 CRITICAL
9.8 Jun 13

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, a

CVE-2012-5574 MEDIUM POC
5.0 Dec 18

lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upl

Share

CVE-2012-6432 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy