Every CVE Search/ Get API key

CVE-2017-11365

Symfony Incorrect Access Control

9.8 CriticalFix available

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.85%Up 1.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.

Record
CVE-2017-11365
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-284
Updated
2026-11-02
CVE List No score

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.

Record
CVE-2017-11365
Updated
2026-11-02
EUVDEUVD-2022-4919 No score

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.

Record
EUVD-2022-4919
Updated
2026-11-03
GitHub AdvisoriesGHSA-q87v-q8fw-gmj5 9.8

Symfony Incorrect Access Control

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.

Record
GHSA-q87v-q8fw-gmj5
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
OSV 9.8

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.

Record
CVE-2017-11365
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-q87v-q8fw-gmj5 9.8

Symfony Incorrect Access Control

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.

Record
GHSA-q87v-q8fw-gmj5
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
OSVUBUNTU-CVE-2017-11365 9.8

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.

Record
UBUNTU-CVE-2017-11365
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
symfony/security-core
Packagist
 2.7.30 up to 2.7.32
2.7.32
symfony/security-core
Packagist
 2.8.23 up to 2.8.25
2.8.25
symfony/security-core
Packagist
 3.2.10 up to 3.2.12
3.2.12
symfony/security-core
Packagist
 3.3.3 up to 3.3.5
3.3.5
symfony/security
Packagist
 2.7.30 up to 2.7.32
2.7.32
symfony/security
Packagist
 2.8.23 up to 2.8.25
2.8.25
symfony/security
Packagist
 3.2.10 up to 3.2.12
3.2.12
symfony/security
Packagist
 3.3.3 up to 3.3.5
3.3.5
symfony/symfony
Packagist
 2.7.30 up to 2.7.32
2.7.32
symfony/symfony
Packagist
 2.8.23 up to 2.8.25
2.8.25
Show 14 moreShow less
Affected packages
PackageAffectedFixed
symfony/symfony
Packagist
 3.2.10 up to 3.2.12
3.2.12
symfony/symfony
Packagist
 3.3.3 up to 3.3.5
3.3.5
symfony/security-core
Packagist
 2.7.30 up to 2.7.32, plus listed versions
v2.7.30v2.7.31
2.7.32
symfony/security-core
Packagist
 2.8.23 up to 2.8.25, plus listed versions
v2.8.23v2.8.24
2.8.25
symfony/security-core
Packagist
 3.2.10 up to 3.2.12, plus listed versions
v3.2.10v3.2.11
3.2.12
symfony/security-core
Packagist
 3.3.3 up to 3.3.5, plus listed versions
v3.3.3v3.3.4
3.3.5
symfony/security
Packagist
 2.7.30 up to 2.7.32, plus listed versions
v2.7.30v2.7.31
2.7.32
symfony/security
Packagist
 2.8.23 up to 2.8.25, plus listed versions
v2.8.23v2.8.24
2.8.25
symfony/security
Packagist
 3.2.10 up to 3.2.12, plus listed versions
v3.2.10v3.2.11
3.2.12
symfony/security
Packagist
 3.3.3 up to 3.3.5, plus listed versions
v3.3.3v3.3.4
3.3.5
symfony/symfony
Packagist
 2.7.30 up to 2.7.32, plus listed versions
v2.7.30v2.7.31
2.7.32
symfony/symfony
Packagist
 2.8.23 up to 2.8.25, plus listed versions
v2.8.23v2.8.24
2.8.25
symfony/symfony
Packagist
 3.2.10 up to 3.2.12, plus listed versions
v3.2.10v3.2.11
3.2.12
symfony/symfony
Packagist
 3.3.3 up to 3.3.5, plus listed versions
v3.3.3v3.3.4
3.3.5

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-11365 is a critical vulnerability (CVSS 9.8) in Sensiolabs Symfony, published May 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in symfony/security-core 2.7.32.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open