CVE-2015-4050
Symfony Incorrect Access Control
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
Exploit likelihood
What each source reports
NVD Score used
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
- Record
CVE-2015-4050- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
- Record
CVE-2015-4050- Updated
- 2026-11-02
EUVDEUVD-2022-5002 No score
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
- Record
EUVD-2022-5002- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qmqw-mpqp-mr54 No score
Symfony Incorrect Access Control
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.
- Record
GHSA-qmqw-mpqp-mr54- Weakness
- CWE-284
- Updated
- 2026-11-02
OSV No score
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
- Record
CVE-2015-4050- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-4050 No score
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
- Record
DEBIAN-CVE-2015-4050- Updated
- 2026-11-02
OSVGHSA-qmqw-mpqp-mr54 No score
Symfony Incorrect Access Control
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.
- Record
GHSA-qmqw-mpqp-mr54- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-4050 No score
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
- Record
UBUNTU-CVE-2015-4050- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/http-kernelPackagist |
2.3.19 up to 2.3.29 | 2.3.29 |
symfony/http-kernelPackagist |
2.5.4 up to 2.5.12 | 2.5.12 |
symfony/http-kernelPackagist |
2.6.0 up to 2.6.8 | 2.6.8 |
symfony/symfonyPackagist |
2.3.19 up to 2.3.29 | 2.3.29 |
symfony/symfonyPackagist |
2.4.9 to 2.4.10 | None known |
symfony/symfonyPackagist |
2.5.4 up to 2.5.12 | 2.5.12 |
symfony/symfonyPackagist |
2.6.0 up to 2.6.8 | 2.6.8 |
symfony/http-kernelPackagist |
2.4.9 to 2.4.10 | None known |
symfonyDebian:12 |
before 2.7.0~beta2+dfsg-2 | 2.7.0~beta2+dfsg-2 |
symfonyDebian:13 |
before 2.7.0~beta2+dfsg-2 | 2.7.0~beta2+dfsg-2 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfonyDebian:14 |
before 2.7.0~beta2+dfsg-2 | 2.7.0~beta2+dfsg-2 |
symfonyDebian:8 |
before 2.3.21+dfsg-4+deb8u1, plus listed versions 2.3.21+dfsg-4 |
2.3.21+dfsg-4+deb8u1 |
symfony/http-kernelPackagist |
2.3.19 up to 2.3.29, plus listed versions v2.3.19v2.3.20v2.3.21v2.3.22v2.3.23 Show 5 moreShow lessv2.3.24v2.3.25v2.3.26v2.3.27v2.3.28 |
2.3.29 |
symfony/http-kernelPackagist |
2.5.4 up to 2.5.12, plus listed versions v2.5.10v2.5.11v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9 |
2.5.12 |
symfony/http-kernelPackagist |
2.6.0 up to 2.6.8, plus listed versions v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7 |
2.6.8 |
symfony/symfonyPackagist |
2.3.19 up to 2.3.29, plus listed versions v2.3.19v2.3.20v2.3.21v2.3.22v2.3.23 Show 5 moreShow lessv2.3.24v2.3.25v2.3.26v2.3.27v2.3.28 |
2.3.29 |
symfony/symfonyPackagist |
2.4.9 to 2.4.10, plus listed versions v2.4.10v2.4.9 |
None known |
symfony/symfonyPackagist |
2.5.4 up to 2.5.12, plus listed versions v2.5.10v2.5.11v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9 |
2.5.12 |
symfony/symfonyPackagist |
2.6.0 up to 2.6.8, plus listed versions v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7 |
2.6.8 |
symfony/http-kernelPackagist |
2.4.9 to 2.4.10, plus listed versions v2.4.10v2.4.9 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Symfony - Authentication Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-4050 is a medium vulnerability (CVSS 4.3) in Sensiolabs Symfony, published May 31, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.21%, the 94th percentile. Fixed in symfony/http-kernel 2.3.29.
References
symfony.com/blog/cve-2015-4050-esi-unauthorized-access
lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html
debian.org/security/2015/dsa-3276
securityfocus.com/bid/74928
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-4050
web.archive.org/web/20200228090443/http://www.securityfocus.com/bid/74928
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2015-4050.yaml
security-tracker.debian.org/tracker/CVE-2015-4050
ubuntu.com/security/CVE-2015-4050
cve.org/CVERecord?id=CVE-2015-4050