search

nexmo-community / befriending-service-with-symfony

MIT License
0 stars 1 forks source link

symfony/form-v5.0.8: 1 vulnerabilities (highest severity is: 5.3) #10

Open mend-for-github-com[bot] opened 1 year ago

mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - symfony/form-v5.0.8

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (symfony/form-v5.0.8 version) Remediation Possible**
CVE-2021-21424 Medium 5.3 symfony/security-core-v5.0.8 Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-21424 ### Vulnerable Library - symfony/security-core-v5.0.8

Symfony Security Component - Core Library

Library home page: https://api.github.com/repos/symfony/security-core/zipball/5945abf1e64df5fdfb6aae9753c04f130fe96010

Dependency Hierarchy: - symfony/form-v5.0.8 (Root Library) - symfony/security-csrf-v5.0.8 - :x: **symfony/security-core-v5.0.8** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.

Publish Date: 2021-05-13

URL: CVE-2021-21424

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68

Release Date: 2021-05-13

Fix Resolution: v3.4.48,v4.4.23,v5.2.8