Every CVESearch/Get API key

CVE-2015-4050

Symfony Incorrect Access Control

4.3 MediumFix available

CVE-2015-4050 is a medium vulnerability (CVSS 4.3) in Sensiolabs Symfony, published May 31, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.21%, the 94th percentile. Fixed in symfony/http-kernel 2.3.29.

What does this mean?
Severity
4.3 MediumCVSS 2.0, NVD
Exploit chance
8.21%EPSS, 94th percentile
Exploitation
None known1 public exploit
Fixed in
2.3.29symfony/http-kernel +19 more

Description

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Exploit likelihood

8.21%Up 6.9 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
symfony/http-kernel
Packagist
2.3.19 up to 2.3.29
2.3.29
symfony/http-kernel
Packagist
2.5.4 up to 2.5.12
2.5.12
symfony/http-kernel
Packagist
2.6.0 up to 2.6.8
2.6.8
symfony/symfony
Packagist
2.3.19 up to 2.3.29
2.3.29
symfony/symfony
Packagist
2.4.9 to 2.4.10None known
symfony/symfony
Packagist
2.5.4 up to 2.5.12
2.5.12
symfony/symfony
Packagist
2.6.0 up to 2.6.8
2.6.8
symfony/http-kernel
Packagist
2.4.9 to 2.4.10None known
symfony
Debian:12
before 2.7.0~beta2+dfsg-2
2.7.0~beta2+dfsg-2
symfony
Debian:13
before 2.7.0~beta2+dfsg-2
2.7.0~beta2+dfsg-2
Show 10 moreShow less
Affected packages
PackageAffectedFixed
symfony
Debian:14
before 2.7.0~beta2+dfsg-2
2.7.0~beta2+dfsg-2
symfony
Debian:8
before 2.3.21+dfsg-4+deb8u1, plus listed versions
2.3.21+dfsg-4
2.3.21+dfsg-4+deb8u1
symfony/http-kernel
Packagist
2.3.19 up to 2.3.29, plus listed versions
v2.3.19v2.3.20v2.3.21v2.3.22v2.3.23
Show 5 moreShow less
v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28
2.3.29
symfony/http-kernel
Packagist
2.5.4 up to 2.5.12, plus listed versions
v2.5.10v2.5.11v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9
2.5.12
symfony/http-kernel
Packagist
2.6.0 up to 2.6.8, plus listed versions
v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7
2.6.8
symfony/symfony
Packagist
2.3.19 up to 2.3.29, plus listed versions
v2.3.19v2.3.20v2.3.21v2.3.22v2.3.23
Show 5 moreShow less
v2.3.24v2.3.25v2.3.26v2.3.27v2.3.28
2.3.29
symfony/symfony
Packagist
2.4.9 to 2.4.10, plus listed versions
v2.4.10v2.4.9
None known
symfony/symfony
Packagist
2.5.4 up to 2.5.12, plus listed versions
v2.5.10v2.5.11v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9
2.5.12
symfony/symfony
Packagist
2.6.0 up to 2.6.8, plus listed versions
v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7
2.6.8
symfony/http-kernel
Packagist
2.4.9 to 2.4.10, plus listed versions
v2.4.10v2.4.9
None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiSymfony - Authentication Bypass

What each source reports

NVD Score used4.3

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
CVE-2015-4050
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-284
Updated
2026-11-02
CVE ListNo score

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
CVE-2015-4050
Updated
2026-11-02
EUVDEUVD-2022-5002No score

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
EUVD-2022-5002
Updated
2026-11-03
GitHub AdvisoriesGHSA-qmqw-mpqp-mr54No score

Symfony Incorrect Access Control

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.

Record
GHSA-qmqw-mpqp-mr54
Weakness
CWE-284
Updated
2026-11-02
OSVNo score

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
CVE-2015-4050
Updated
2026-11-02
OSVDEBIAN-CVE-2015-4050No score

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
DEBIAN-CVE-2015-4050
Updated
2026-11-02
OSVGHSA-qmqw-mpqp-mr54No score

Symfony Incorrect Access Control

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.

Record
GHSA-qmqw-mpqp-mr54
Weakness
CWE-284
Updated
2026-11-02
OSVUBUNTU-CVE-2015-4050No score

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

Record
UBUNTU-CVE-2015-4050
Updated
2026-11-02

History

History
RecordedChangedSources
facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 9 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open