Every CVE Search/ Get API key

CVE-2015-4050

Symfony Incorrect Access Control

4.3 MediumFix available

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Exploit likelihood

8.21%Up 6.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
CVE-2015-4050
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-284
Updated
2026-11-02
CVE List No score

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
CVE-2015-4050
Updated
2026-11-02
EUVDEUVD-2022-5002 No score

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
EUVD-2022-5002
Updated
2026-11-03
GitHub AdvisoriesGHSA-qmqw-mpqp-mr54 No score

Symfony Incorrect Access Control

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.

Record
GHSA-qmqw-mpqp-mr54
Weakness
CWE-284
Updated
2026-11-02
OSV No score

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
CVE-2015-4050
Updated
2026-11-02
OSVDEBIAN-CVE-2015-4050 No score

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
DEBIAN-CVE-2015-4050
Updated
2026-11-02
OSVGHSA-qmqw-mpqp-mr54 No score

Symfony Incorrect Access Control

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.

Record
GHSA-qmqw-mpqp-mr54
Weakness
CWE-284
Updated
2026-11-02
OSVUBUNTU-CVE-2015-4050 No score

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
UBUNTU-CVE-2015-4050
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
symfony/http-kernel
Packagist
 2.3.19 up to 2.3.29
2.3.29
symfony/http-kernel
Packagist
 2.5.4 up to 2.5.12
2.5.12
symfony/http-kernel
Packagist
 2.6.0 up to 2.6.8
2.6.8
symfony/symfony
Packagist
 2.3.19 up to 2.3.29
2.3.29
symfony/symfony
Packagist
 2.4.9 to 2.4.10 None known
symfony/symfony
Packagist
 2.5.4 up to 2.5.12
2.5.12
symfony/symfony
Packagist
 2.6.0 up to 2.6.8
2.6.8
symfony/http-kernel
Packagist
 2.4.9 to 2.4.10 None known
symfony
Debian:12
 before 2.7.0~beta2+dfsg-2
2.7.0~beta2+dfsg-2
symfony
Debian:13
 before 2.7.0~beta2+dfsg-2
2.7.0~beta2+dfsg-2
Show 10 moreShow less
Affected packages
PackageAffectedFixed
symfony
Debian:14
 before 2.7.0~beta2+dfsg-2
2.7.0~beta2+dfsg-2
symfony
Debian:8
 before 2.3.21+dfsg-4+deb8u1, plus listed versions
2.3.21+dfsg-4
2.3.21+dfsg-4+deb8u1
symfony/http-kernel
Packagist
 2.3.19 up to 2.3.29, plus listed versions
v2.3.19v2.3.20v2.3.21v2.3.22v2.3.23
Show 5 moreShow less
v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28
2.3.29
symfony/http-kernel
Packagist
 2.5.4 up to 2.5.12, plus listed versions
v2.5.10v2.5.11v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9
2.5.12
symfony/http-kernel
Packagist
 2.6.0 up to 2.6.8, plus listed versions
v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7
2.6.8
symfony/symfony
Packagist
 2.3.19 up to 2.3.29, plus listed versions
v2.3.19v2.3.20v2.3.21v2.3.22v2.3.23
Show 5 moreShow less
v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28
2.3.29
symfony/symfony
Packagist
 2.4.9 to 2.4.10, plus listed versions
v2.4.10v2.4.9
 None known
symfony/symfony
Packagist
 2.5.4 up to 2.5.12, plus listed versions
v2.5.10v2.5.11v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9
2.5.12
symfony/symfony
Packagist
 2.6.0 up to 2.6.8, plus listed versions
v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7
2.6.8
symfony/http-kernel
Packagist
 2.4.9 to 2.4.10, plus listed versions
v2.4.10v2.4.9
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiSymfony - Authentication Bypass

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-4050 is a medium vulnerability (CVSS 4.3) in Sensiolabs Symfony, published May 31, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.21%, the 94th percentile. Fixed in symfony/http-kernel 2.3.29.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open