{"id":"CVE-2012-6432","aliases":["EUVD-2022-3155","GHSA-89cp-fvcc-hxh7"],"status":"published","title":"Symfony Access Control Vulnerability","description":"Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01173,"percentile":0.67681,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-284"],"published":"2012-12-27T11:00:00Z","modified":"2026-06-16T23:48:05Z","fixes":[{"ecosystem":"Packagist","package":"symfony/symfony","fixed_in":["2.0.20","2.1.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2-dev"},{"last_affected":"2.2-dev"}]}],"versions":["2.2-dev"]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.20"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.5"}]}]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","versions":["2.2-dev"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.20"}]}],"versions":["2.0.4","2.0.5","2.0.6","2.0.7","v2.0.10","v2.0.11","v2.0.12","v2.0.13","v2.0.14","v2.0.15","v2.0.16","v2.0.17","v2.0.18","v2.0.19","v2.0.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.5"}]}],"versions":["v2.1.0","v2.1.1","v2.1.2","v2.1.3","v2.1.4"]}],"products":[{"vendor":"sensiolabs","product":"symfony"}],"references":[{"url":"http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6432","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2012-6432.yaml","tags":["web"]},{"url":"https://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released","tags":["web"]},{"url":"https://github.com/advisories/GHSA-89cp-fvcc-hxh7"},{"url":"https://github.com/symfony/symfony","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2012-6432","description":"Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.","status":"published","published":"2012-12-27T11:00:00Z","modified":"2024-09-16T20:06:59.052Z","updated_at":"2026-11-02T14:34:51.269982Z"}],"euvd":[{"id":"EUVD-2022-3155","description":"Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.","status":"published","published":"2012-12-27T11:00:00Z","modified":"2024-09-16T20:06:59Z","updated_at":"2026-11-03T00:55:16.813871Z"}],"ghsa":[{"id":"GHSA-89cp-fvcc-hxh7","title":"Symfony Access Control Vulnerability","description":"Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a `/_internal` substring.","status":"published","published":"2022-05-17T05:17:45Z","modified":"2024-02-06T16:02:11Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:36.076201Z"}],"nvd":[{"id":"CVE-2012-6432","description":"Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.","status":"published","published":"2012-12-27T11:47:01.837Z","modified":"2026-06-16T23:48:05.563Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:16.958223Z"}],"osv":[{"id":"GHSA-89cp-fvcc-hxh7","title":"Symfony Access Control Vulnerability","description":"Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a `/_internal` substring.","status":"published","published":"2022-05-17T05:17:45Z","modified":"2024-12-02T05:41:26.708784Z","cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:42.077781Z"}]}}