Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-7ms4-3hc6-8bgv
Summary
Symfony may allow a user to switch to using another user's identity
Symfony 2.0.6 has just been released. It addresses a security vulnerability in the EntityUserProvider as provided in the Doctrine bridge.

If you let your users update their login/username from a form, and if you are using Doctrine as a user provider, then you are vulnerable and you should upgrade as soon as possible.

The issue is that it is possible for a user to switch to another one. Here is how to reproduce it: The current user changes its username via a form to another existing username. When the form is submitted, he will have a validation error (as the username already exists) but the user object in the session will still be modified to the new username. This user from the session will be used for the next requests and so the user will be switched to this other user.

The fix is to always refresh the user via the primary key (which cannot be updated via a form) instead of the username.

If you cannot upgrade immediately, please apply the following patch: https://github.com/symfony/symfony/commit/9d2ab9ca9c1762
Aliases
0
alias GHSA-7mx2-7q8p-pgmw
Fixed_packages
0
url pkg:composer/symfony/symfony@2.0.6
purl pkg:composer/symfony/symfony@2.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-4num-z8cg-83gt
4
vulnerability VCID-556v-rym3-6yax
5
vulnerability VCID-6cea-up73-y3hn
6
vulnerability VCID-6z5x-uwjt-uueq
7
vulnerability VCID-71vh-7wte-kfcx
8
vulnerability VCID-9bzz-84cq-ykh2
9
vulnerability VCID-ahhz-bs6u-f3bc
10
vulnerability VCID-bdhj-np35-sybt
11
vulnerability VCID-bhfu-7788-fbhc
12
vulnerability VCID-bny7-h1nn-bkbc
13
vulnerability VCID-c8ar-82sr-fqej
14
vulnerability VCID-d1kp-7aht-9qa2
15
vulnerability VCID-fgxs-w84s-8kh3
16
vulnerability VCID-hzwd-mq3r-qfcb
17
vulnerability VCID-jdsd-3vnz-uygn
18
vulnerability VCID-jjqk-u4vs-tbba
19
vulnerability VCID-k37h-bhh2-myaj
20
vulnerability VCID-k8ze-h7fe-fkg2
21
vulnerability VCID-kgu6-gj5d-7bfx
22
vulnerability VCID-neyj-8fkw-fyb7
23
vulnerability VCID-nsk8-bk5e-tbfh
24
vulnerability VCID-p1dw-w76f-gbfv
25
vulnerability VCID-qty4-cyfa-rugw
26
vulnerability VCID-qwcj-hq3g-2qd7
27
vulnerability VCID-rgh3-ef8t-k3ec
28
vulnerability VCID-rxbg-gmn6-kbeq
29
vulnerability VCID-rztj-ug83-dyga
30
vulnerability VCID-sfzy-423b-j3b4
31
vulnerability VCID-skth-cf6d-3ubr
32
vulnerability VCID-srrc-wxew-1fc6
33
vulnerability VCID-thtp-ehsj-t3ej
34
vulnerability VCID-u84h-sr6a-4uc7
35
vulnerability VCID-unuf-vj1b-qbhr
36
vulnerability VCID-wwhm-mrr3-v7h3
37
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.6
Affected_packages
0
url pkg:composer/symfony/symfony@2.0.0
purl pkg:composer/symfony/symfony@2.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-556v-rym3-6yax
4
vulnerability VCID-6cea-up73-y3hn
5
vulnerability VCID-6z5x-uwjt-uueq
6
vulnerability VCID-71vh-7wte-kfcx
7
vulnerability VCID-742s-vczp-tuh1
8
vulnerability VCID-7ms4-3hc6-8bgv
9
vulnerability VCID-ahhz-bs6u-f3bc
10
vulnerability VCID-bdhj-np35-sybt
11
vulnerability VCID-bhfu-7788-fbhc
12
vulnerability VCID-bny7-h1nn-bkbc
13
vulnerability VCID-d1kp-7aht-9qa2
14
vulnerability VCID-fgxs-w84s-8kh3
15
vulnerability VCID-hzwd-mq3r-qfcb
16
vulnerability VCID-jdsd-3vnz-uygn
17
vulnerability VCID-jjqk-u4vs-tbba
18
vulnerability VCID-k37h-bhh2-myaj
19
vulnerability VCID-neyj-8fkw-fyb7
20
vulnerability VCID-p1dw-w76f-gbfv
21
vulnerability VCID-qty4-cyfa-rugw
22
vulnerability VCID-rgh3-ef8t-k3ec
23
vulnerability VCID-rxbg-gmn6-kbeq
24
vulnerability VCID-rztj-ug83-dyga
25
vulnerability VCID-sfzy-423b-j3b4
26
vulnerability VCID-srrc-wxew-1fc6
27
vulnerability VCID-thtp-ehsj-t3ej
28
vulnerability VCID-u84h-sr6a-4uc7
29
vulnerability VCID-unuf-vj1b-qbhr
30
vulnerability VCID-wwhm-mrr3-v7h3
31
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.0
1
url pkg:composer/symfony/symfony@2.0.4
purl pkg:composer/symfony/symfony@2.0.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-4num-z8cg-83gt
4
vulnerability VCID-556v-rym3-6yax
5
vulnerability VCID-6cea-up73-y3hn
6
vulnerability VCID-6z5x-uwjt-uueq
7
vulnerability VCID-71vh-7wte-kfcx
8
vulnerability VCID-742s-vczp-tuh1
9
vulnerability VCID-7ms4-3hc6-8bgv
10
vulnerability VCID-9bzz-84cq-ykh2
11
vulnerability VCID-ahhz-bs6u-f3bc
12
vulnerability VCID-bdhj-np35-sybt
13
vulnerability VCID-bhfu-7788-fbhc
14
vulnerability VCID-bny7-h1nn-bkbc
15
vulnerability VCID-c8ar-82sr-fqej
16
vulnerability VCID-d1kp-7aht-9qa2
17
vulnerability VCID-fgxs-w84s-8kh3
18
vulnerability VCID-hzwd-mq3r-qfcb
19
vulnerability VCID-jdsd-3vnz-uygn
20
vulnerability VCID-jjqk-u4vs-tbba
21
vulnerability VCID-k37h-bhh2-myaj
22
vulnerability VCID-k8ze-h7fe-fkg2
23
vulnerability VCID-kgu6-gj5d-7bfx
24
vulnerability VCID-neyj-8fkw-fyb7
25
vulnerability VCID-nsk8-bk5e-tbfh
26
vulnerability VCID-p1dw-w76f-gbfv
27
vulnerability VCID-qty4-cyfa-rugw
28
vulnerability VCID-qwcj-hq3g-2qd7
29
vulnerability VCID-rgh3-ef8t-k3ec
30
vulnerability VCID-rxbg-gmn6-kbeq
31
vulnerability VCID-rztj-ug83-dyga
32
vulnerability VCID-sfzy-423b-j3b4
33
vulnerability VCID-skth-cf6d-3ubr
34
vulnerability VCID-srrc-wxew-1fc6
35
vulnerability VCID-thtp-ehsj-t3ej
36
vulnerability VCID-u84h-sr6a-4uc7
37
vulnerability VCID-unuf-vj1b-qbhr
38
vulnerability VCID-wwhm-mrr3-v7h3
39
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.4
2
url pkg:composer/symfony/symfony@2.0.5
purl pkg:composer/symfony/symfony@2.0.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-4num-z8cg-83gt
4
vulnerability VCID-556v-rym3-6yax
5
vulnerability VCID-6cea-up73-y3hn
6
vulnerability VCID-6z5x-uwjt-uueq
7
vulnerability VCID-71vh-7wte-kfcx
8
vulnerability VCID-742s-vczp-tuh1
9
vulnerability VCID-7ms4-3hc6-8bgv
10
vulnerability VCID-9bzz-84cq-ykh2
11
vulnerability VCID-ahhz-bs6u-f3bc
12
vulnerability VCID-bdhj-np35-sybt
13
vulnerability VCID-bhfu-7788-fbhc
14
vulnerability VCID-bny7-h1nn-bkbc
15
vulnerability VCID-c8ar-82sr-fqej
16
vulnerability VCID-d1kp-7aht-9qa2
17
vulnerability VCID-fgxs-w84s-8kh3
18
vulnerability VCID-hzwd-mq3r-qfcb
19
vulnerability VCID-jdsd-3vnz-uygn
20
vulnerability VCID-jjqk-u4vs-tbba
21
vulnerability VCID-k37h-bhh2-myaj
22
vulnerability VCID-k8ze-h7fe-fkg2
23
vulnerability VCID-kgu6-gj5d-7bfx
24
vulnerability VCID-neyj-8fkw-fyb7
25
vulnerability VCID-nsk8-bk5e-tbfh
26
vulnerability VCID-p1dw-w76f-gbfv
27
vulnerability VCID-qty4-cyfa-rugw
28
vulnerability VCID-qwcj-hq3g-2qd7
29
vulnerability VCID-rgh3-ef8t-k3ec
30
vulnerability VCID-rxbg-gmn6-kbeq
31
vulnerability VCID-rztj-ug83-dyga
32
vulnerability VCID-sfzy-423b-j3b4
33
vulnerability VCID-skth-cf6d-3ubr
34
vulnerability VCID-srrc-wxew-1fc6
35
vulnerability VCID-thtp-ehsj-t3ej
36
vulnerability VCID-u84h-sr6a-4uc7
37
vulnerability VCID-unuf-vj1b-qbhr
38
vulnerability VCID-wwhm-mrr3-v7h3
39
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.5
References
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/2011-11-16.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/2011-11-16.yaml
1
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
2
reference_url https://github.com/symfony/symfony/commit/9d2ab9ca9c1762
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/9d2ab9ca9c1762
3
reference_url https://symfony.com/blog/security-release-symfony-2-0-6
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/security-release-symfony-2-0-6
4
reference_url https://github.com/advisories/GHSA-7mx2-7q8p-pgmw
reference_id GHSA-7mx2-7q8p-pgmw
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7mx2-7q8p-pgmw
Weaknesses
0
cwe_id 287
name Improper Authentication
description When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-7ms4-3hc6-8bgv