Every CVE Search/ Get API key

CVE-2015-8125

Symfony Vulnerable to Timing Attack

7.5 HighFix available

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Exploit likelihood

2.54%Up 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Record
CVE-2015-8125
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Record
CVE-2015-8125
Updated
2026-11-02
EUVDEUVD-2022-3930 No score

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Record
EUVD-2022-3930
Updated
2026-11-03
GitHub AdvisoriesGHSA-g97c-jfx6-xvxh No score

Symfony Vulnerable to Timing Attack

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Record
GHSA-g97c-jfx6-xvxh
Weakness
CWE-208
Updated
2026-11-02
OSV No score

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Record
CVE-2015-8125
Updated
2026-11-02
OSVDEBIAN-CVE-2015-8125 No score

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Record
DEBIAN-CVE-2015-8125
Updated
2026-11-02
OSVGHSA-g97c-jfx6-xvxh No score

Symfony Vulnerable to Timing Attack

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Record
GHSA-g97c-jfx6-xvxh
Weakness
CWE-208
Updated
2026-11-02
OSVUBUNTU-CVE-2015-8125 No score

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Record
UBUNTU-CVE-2015-8125
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
symfony/symfony
Packagist
 2.3.0 up to 2.3.35
2.3.35
symfony/symfony
Packagist
 2.7.0 up to 2.7.7
2.7.7
symfony/form
Packagist
 2.3.0 up to 2.3.35
2.3.35
symfony/form
Packagist
 2.4.0 up to 2.6.12
2.6.12
symfony/form
Packagist
 2.7.0 up to 2.7.7
2.7.7
symfony/security-http
Packagist
 2.4.0 up to 2.6.12
2.6.12
symfony/security-http
Packagist
 2.7.0 up to 2.7.7
2.7.7
symfony/security
Packagist
 2.3.0 up to 2.3.35
2.3.35
symfony/security
Packagist
 2.4.0 up to 2.6.12
2.6.12
symfony/security
Packagist
 2.7.0 up to 2.7.7
2.7.7
Show 16 moreShow less
Affected packages
PackageAffectedFixed
symfony/symfony
Packagist
 2.4.0 up to 2.6.12
2.6.12
symfony
Debian:12
 before 2.7.7+dfsg-1
2.7.7+dfsg-1
symfony
Debian:13
 before 2.7.7+dfsg-1
2.7.7+dfsg-1
symfony
Debian:14
 before 2.7.7+dfsg-1
2.7.7+dfsg-1
symfony
Debian:8
From an advisory covering 2 CVEs
 before 2.3.21+dfsg-4+deb8u2, plus listed versions
2.3.21+dfsg-42.3.21+dfsg-4+deb8u1
2.3.21+dfsg-4+deb8u2
symfony/symfony
Packagist
 2.3.0 up to 2.3.35, plus listed versions
v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12
Show 30 moreShow less
v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9
2.3.35
symfony/symfony
Packagist
 2.7.0 up to 2.7.7, plus listed versions
v2.7.0v2.7.1v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6
2.7.7
symfony/form
Packagist
 2.3.0 up to 2.3.35, plus listed versions
v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12
Show 30 moreShow less
v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9
2.3.35
symfony/form
Packagist
 2.4.0 up to 2.6.12, plus listed versions
v2.4.0v2.4.1v2.4.10v2.4.2v2.4.3
Show 36 moreShow less
v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9
2.6.12
symfony/form
Packagist
 2.7.0 up to 2.7.7, plus listed versions
v2.7.0v2.7.1v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6
2.7.7
symfony/security-http
Packagist
 2.4.0 up to 2.6.12, plus listed versions
v2.4.0v2.4.1v2.4.10v2.4.2v2.4.3
Show 36 moreShow less
v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9
2.6.12
symfony/security-http
Packagist
 2.7.0 up to 2.7.7, plus listed versions
v2.7.0v2.7.1v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6
2.7.7
symfony/security
Packagist
 2.3.0 up to 2.3.35, plus listed versions
v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12
Show 30 moreShow less
v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28v2.3.29v2.3.3v2.3.30v2.3.31v2.3.32v2.3.33v2.3.34v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9
2.3.35
symfony/security
Packagist
 2.4.0 up to 2.6.12, plus listed versions
v2.4.0v2.4.1v2.4.10v2.4.2v2.4.3
Show 36 moreShow less
v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9
2.6.12
symfony/security
Packagist
 2.7.0 up to 2.7.7, plus listed versions
v2.7.0v2.7.1v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6
2.7.7
symfony/symfony
Packagist
 2.4.0 up to 2.6.12, plus listed versions
v2.4.0v2.4.1v2.4.10v2.4.2v2.4.3
Show 36 moreShow less
v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-BETA1v2.5.0-BETA2v2.5.0-RC1v2.5.1v2.5.10v2.5.11v2.5.12v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-BETA1v2.6.0-BETA2v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9
2.6.12

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-8125 is a high vulnerability (CVSS 7.5) in Sensiolabs Symfony, published November 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.54%, the 85th percentile. Fixed in symfony/symfony 2.3.35.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open