CVE-2012-6432
Symfony Access Control Vulnerability
CVE-2012-6432 is a medium vulnerability (CVSS 6.8) in Sensiolabs Symfony, published December 27, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in symfony/symfony 2.0.20.
Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.
Exploit likelihood
What each source reports
NVD Score used
Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.
- Record
CVE-2012-6432- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.
- Record
CVE-2012-6432- Updated
- 2026-11-02
EUVDEUVD-2022-3155 No score
Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.
- Record
EUVD-2022-3155- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-89cp-fvcc-hxh7 No score
Symfony Access Control Vulnerability
Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.
- Record
GHSA-89cp-fvcc-hxh7- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-89cp-fvcc-hxh7 No score
Symfony Access Control Vulnerability
Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.
- Record
GHSA-89cp-fvcc-hxh7- Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/symfonyPackagist |
2.2-dev to 2.2-dev | None known |
symfony/symfonyPackagist |
2.0.0 up to 2.0.20 | 2.0.20 |
symfony/symfonyPackagist |
2.1.0 up to 2.1.5 | 2.1.5 |
symfony/symfonyPackagist |
Listed versions 2.2-dev |
None known |
symfony/symfonyPackagist |
2.0.0 up to 2.0.20, plus listed versions 2.0.42.0.52.0.62.0.7v2.0.10 Show 10 moreShow lessv2.0.11v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.9 |
2.0.20 |
symfony/symfonyPackagist |
2.1.0 up to 2.1.5, plus listed versions v2.1.0v2.1.1v2.1.2v2.1.3v2.1.4 |
2.1.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |