Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/symfony/security@2.3.2
Typecomposer
Namespacesymfony
Namesecurity
Version2.3.2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.7.51
Latest_non_vulnerable_version4.4.24
Affected_by_vulnerabilities
0
url VCID-ef86-hqv4-6kaz
vulnerability_id VCID-ef86-hqv4-6kaz
summary 
Cross-Site Request Forgery (CSRF)
By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the `invalidate_session` option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-11406
reference_id
reference_type
scores
0
value 0.00184
scoring_system epss
scoring_elements 0.39996
published_at 2026-06-05T12:55:00Z
1
value 0.00184
scoring_system epss
scoring_elements 0.39914
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-11406
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2403
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2403
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16652
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16652
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16653
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16653
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16654
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16654
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16790
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16790
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11385
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11385
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11386
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11386
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11406
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11406
9
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2018-11406.yaml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2018-11406.yaml
10
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11406.yaml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11406.yaml
11
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11406.yaml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11406.yaml
12
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11406.yaml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11406.yaml
13
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
14
reference_url https://github.com/symfony/symfony/commit/319e1bdd43979d9c1559497de8d69adea28ab8d1
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/319e1bdd43979d9c1559497de8d69adea28ab8d1
15
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
16
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
17
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH
18
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-11406
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-11406
19
reference_url https://symfony.com/blog/cve-2018-11406-csrf-token-fixation
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2018-11406-csrf-token-fixation
20
reference_url https://www.debian.org/security/2018/dsa-4262
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2018/dsa-4262
21
reference_url https://symfony.com/cve-2018-11406
reference_id CVE-2018-11406
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2018-11406
fixed_packages
0
url pkg:composer/symfony/security@2.7.48
purl pkg:composer/symfony/security@2.7.48
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-ef86-hqv4-6kaz
2
vulnerability VCID-mew1-9shg-mugs
3
vulnerability VCID-vyug-krcw-jyef
4
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.7.48
1
url pkg:composer/symfony/security@2.8.41
purl pkg:composer/symfony/security@2.8.41
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-mew1-9shg-mugs
2
vulnerability VCID-p6f7-utd6-eqej
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.8.41
2
url pkg:composer/symfony/security@3.3.17
purl pkg:composer/symfony/security@3.3.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-ef86-hqv4-6kaz
2
vulnerability VCID-mew1-9shg-mugs
3
vulnerability VCID-p6f7-utd6-eqej
4
vulnerability VCID-uuk9-e5qy-rfgf
5
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@3.3.17
3
url pkg:composer/symfony/security@3.4.11
purl pkg:composer/symfony/security@3.4.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-mew1-9shg-mugs
2
vulnerability VCID-p6f7-utd6-eqej
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@3.4.11
4
url pkg:composer/symfony/security@4.0.11
purl pkg:composer/symfony/security@4.0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-mew1-9shg-mugs
2
vulnerability VCID-p6f7-utd6-eqej
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@4.0.11
aliases CVE-2018-11406, GHSA-g4g7-q726-v5hg
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ef86-hqv4-6kaz
1
url VCID-gjuz-mjah-e3bj
vulnerability_id VCID-gjuz-mjah-e3bj
summary 
Information Exposure Through Timing Discrepancy
Symfony allows remote attackers to have unspecified impact via a timing attack.
references
0
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2015-8125
reference_id
reference_type
scores
0
value 0.01008
scoring_system epss
scoring_elements 0.77412
published_at 2026-06-04T12:55:00Z
1
value 0.01008
scoring_system epss
scoring_elements 0.77439
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2015-8125
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8124
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8124
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8125
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8125
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/form/CVE-2015-8125.yaml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/form/CVE-2015-8125.yaml
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8125.yaml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8125.yaml
7
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8125.yaml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8125.yaml
8
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8125.yaml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8125.yaml
9
reference_url https://github.com/symfony/symfony/pull/16630
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/pull/16630
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2015-8125
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2015-8125
11
reference_url https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service
12
reference_url https://web.archive.org/web/20200228050051/http://www.securityfocus.com/bid/77692
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200228050051/http://www.securityfocus.com/bid/77692
13
reference_url http://www.debian.org/security/2015/dsa-3402
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2015/dsa-3402
14
reference_url http://www.securityfocus.com/bid/77692
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/77692
15
reference_url https://symfony.com/cve-2015-8125
reference_id CVE-2015-8125
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2015-8125
fixed_packages
0
url pkg:composer/symfony/security@2.3.35
purl pkg:composer/symfony/security@2.3.35
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ef86-hqv4-6kaz
1
vulnerability VCID-uk5a-g7em-gygd
2
vulnerability VCID-vyug-krcw-jyef
3
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.3.35
1
url pkg:composer/symfony/security@2.6.12
purl pkg:composer/symfony/security@2.6.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ef86-hqv4-6kaz
1
vulnerability VCID-uk5a-g7em-gygd
2
vulnerability VCID-vyug-krcw-jyef
3
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.6.12
2
url pkg:composer/symfony/security@2.7.7
purl pkg:composer/symfony/security@2.7.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-djnm-e9r4-c3f5
2
vulnerability VCID-dsbx-q641-4fc7
3
vulnerability VCID-ef86-hqv4-6kaz
4
vulnerability VCID-uk5a-g7em-gygd
5
vulnerability VCID-vyug-krcw-jyef
6
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.7.7
aliases CVE-2015-8125, GHSA-g97c-jfx6-xvxh
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gjuz-mjah-e3bj
2
url VCID-rkap-39hu-abe9
vulnerability_id VCID-rkap-39hu-abe9
summary 
Uncontrolled Resource Consumption
The Security component in Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-5958
reference_id
reference_type
scores
0
value 0.00474
scoring_system epss
scoring_elements 0.65144
published_at 2026-06-05T12:55:00Z
1
value 0.00474
scoring_system epss
scoring_elements 0.65101
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-5958
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill/CVE-2013-5958.yaml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill/CVE-2013-5958.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2013-5958.yaml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2013-5958.yaml
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-5958.yaml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-5958.yaml
4
reference_url https://github.com/symfony/polyfill/pull/155
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/polyfill/pull/155
5
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
6
reference_url https://github.com/symfony/symfony/issues/11522
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/issues/11522
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-5958
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-5958
8
reference_url https://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released
9
reference_url http://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released
fixed_packages
0
url pkg:composer/symfony/security@2.3.6
purl pkg:composer/symfony/security@2.3.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ef86-hqv4-6kaz
1
vulnerability VCID-gjuz-mjah-e3bj
2
vulnerability VCID-ty9b-xe8v-r7ag
3
vulnerability VCID-uk5a-g7em-gygd
4
vulnerability VCID-vyug-krcw-jyef
5
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.3.6
aliases CVE-2013-5958, GHSA-cr49-fx2v-9p57
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-rkap-39hu-abe9
3
url VCID-ty9b-xe8v-r7ag
vulnerability_id VCID-ty9b-xe8v-r7ag
summary 
Session Fixation
Session fixation vulnerability in the `Remember Me` login feature in Symfony allows remote attackers to hijack web sessions via a session id.
references
0
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2015-8124
reference_id
reference_type
scores
0
value 0.00304
scoring_system epss
scoring_elements 0.53998
published_at 2026-06-05T12:55:00Z
1
value 0.00304
scoring_system epss
scoring_elements 0.5394
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2015-8124
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8124
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8124
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8125
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8125
5
reference_url http://seclists.org/fulldisclosure/2015/Dec/89
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://seclists.org/fulldisclosure/2015/Dec/89
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8124.yaml
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8124.yaml
7
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8124.yaml
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8124.yaml
8
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8124.yaml
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8124.yaml
9
reference_url https://github.com/symfony/symfony/pull/16631
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/pull/16631
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2015-8124
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2015-8124
11
reference_url https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature
12
reference_url https://web.archive.org/web/20201209020014/http://www.securityfocus.com/archive/1/537183/100/0/threaded
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201209020014/http://www.securityfocus.com/archive/1/537183/100/0/threaded
13
reference_url https://web.archive.org/web/20210125123853/http://www.securityfocus.com/bid/77694
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210125123853/http://www.securityfocus.com/bid/77694
14
reference_url http://www.debian.org/security/2015/dsa-3402
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2015/dsa-3402
15
reference_url https://symfony.com/cve-2015-8124
reference_id CVE-2015-8124
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2015-8124
fixed_packages
0
url pkg:composer/symfony/security@2.3.35
purl pkg:composer/symfony/security@2.3.35
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ef86-hqv4-6kaz
1
vulnerability VCID-uk5a-g7em-gygd
2
vulnerability VCID-vyug-krcw-jyef
3
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.3.35
1
url pkg:composer/symfony/security@2.6.12
purl pkg:composer/symfony/security@2.6.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ef86-hqv4-6kaz
1
vulnerability VCID-uk5a-g7em-gygd
2
vulnerability VCID-vyug-krcw-jyef
3
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.6.12
2
url pkg:composer/symfony/security@2.7.7
purl pkg:composer/symfony/security@2.7.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-djnm-e9r4-c3f5
2
vulnerability VCID-dsbx-q641-4fc7
3
vulnerability VCID-ef86-hqv4-6kaz
4
vulnerability VCID-uk5a-g7em-gygd
5
vulnerability VCID-vyug-krcw-jyef
6
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.7.7
aliases CVE-2015-8124, GHSA-j5jh-hpr4-h332
risk_score 1.4
exploitability 0.5
weighted_severity 2.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ty9b-xe8v-r7ag
4
url VCID-uk5a-g7em-gygd
vulnerability_id VCID-uk5a-g7em-gygd
summary 
Cryptographic Issues
The `nextBytes` function in the `SecureRandom` class in Symfony does not properly generate random numbers when used with PHP without the `paragonie/random_compat` library and the `openssl_random_pseudo_bytes` function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-1902
reference_id
reference_type
scores
0
value 0.00397
scoring_system epss
scoring_elements 0.60845
published_at 2026-06-05T12:55:00Z
1
value 0.00397
scoring_system epss
scoring_elements 0.60795
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-1902
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1902
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1902
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4423
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4423
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-1902.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-1902.yaml
4
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-1902.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-1902.yaml
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-1902.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-1902.yaml
6
reference_url https://github.com/symfony/symfony/pull/17359
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/pull/17359
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-1902
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-1902
8
reference_url https://www.landaire.net/blog/cve-2016-1902-symfony-securerandom
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.landaire.net/blog/cve-2016-1902-symfony-securerandom
9
reference_url http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails
10
reference_url http://www.debian.org/security/2016/dsa-3588
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2016/dsa-3588
11
reference_url https://symfony.com/cve-2016-1902
reference_id CVE-2016-1902
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2016-1902
fixed_packages
0
url pkg:composer/symfony/security@2.3.37
purl pkg:composer/symfony/security@2.3.37
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ef86-hqv4-6kaz
1
vulnerability VCID-vyug-krcw-jyef
2
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.3.37
1
url pkg:composer/symfony/security@2.6.13
purl pkg:composer/symfony/security@2.6.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ef86-hqv4-6kaz
1
vulnerability VCID-vyug-krcw-jyef
2
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.6.13
2
url pkg:composer/symfony/security@2.7.9
purl pkg:composer/symfony/security@2.7.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-djnm-e9r4-c3f5
2
vulnerability VCID-dsbx-q641-4fc7
3
vulnerability VCID-ef86-hqv4-6kaz
4
vulnerability VCID-vyug-krcw-jyef
5
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.7.9
aliases CVE-2016-1902, GHSA-jjx5-fq5g-8xpc
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uk5a-g7em-gygd
5
url VCID-vyug-krcw-jyef
vulnerability_id VCID-vyug-krcw-jyef
summary 
Session Fixation
A session fixation vulnerability within the `Guard` login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-11385
reference_id
reference_type
scores
0
value 0.00904
scoring_system epss
scoring_elements 0.76092
published_at 2026-06-04T12:55:00Z
1
value 0.00904
scoring_system epss
scoring_elements 0.76117
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-11385
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2403
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2403
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16652
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16652
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16653
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16653
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16654
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16654
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16790
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16790
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11385
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11385
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11386
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11386
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11406
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11406
9
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11385.yaml
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11385.yaml
10
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11385.yaml
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11385.yaml
11
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11385.yaml
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11385.yaml
12
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
13
reference_url https://github.com/symfony/symfony/commit/194caff28b56707ea98e746c6582c06acbb9bc3f
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/194caff28b56707ea98e746c6582c06acbb9bc3f
14
reference_url https://github.com/symfony/symfony/commit/fa5bf4b17d45ee32f41bd1a9abc3fb6c134ec89b
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/fa5bf4b17d45ee32f41bd1a9abc3fb6c134ec89b
15
reference_url https://github.com/symfony/symfony/commit/fad1e1f2ea336e85c889feece9d0e23fbfcf777d
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/fad1e1f2ea336e85c889feece9d0e23fbfcf777d
16
reference_url https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
17
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
18
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
19
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH
20
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-11385
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-11385
21
reference_url https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authentication
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authentication
22
reference_url https://www.debian.org/security/2018/dsa-4262
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2018/dsa-4262
23
reference_url https://symfony.com/cve-2018-11385
reference_id CVE-2018-11385
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2018-11385
fixed_packages
0
url pkg:composer/symfony/security@2.7.48
purl pkg:composer/symfony/security@2.7.48
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-ef86-hqv4-6kaz
2
vulnerability VCID-mew1-9shg-mugs
3
vulnerability VCID-vyug-krcw-jyef
4
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.7.48
1
url pkg:composer/symfony/security@2.8.41
purl pkg:composer/symfony/security@2.8.41
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-mew1-9shg-mugs
2
vulnerability VCID-p6f7-utd6-eqej
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.8.41
2
url pkg:composer/symfony/security@3.3.17
purl pkg:composer/symfony/security@3.3.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-ef86-hqv4-6kaz
2
vulnerability VCID-mew1-9shg-mugs
3
vulnerability VCID-p6f7-utd6-eqej
4
vulnerability VCID-uuk9-e5qy-rfgf
5
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@3.3.17
3
url pkg:composer/symfony/security@3.4.11
purl pkg:composer/symfony/security@3.4.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-mew1-9shg-mugs
2
vulnerability VCID-p6f7-utd6-eqej
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@3.4.11
4
url pkg:composer/symfony/security@4.0.11
purl pkg:composer/symfony/security@4.0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-mew1-9shg-mugs
2
vulnerability VCID-p6f7-utd6-eqej
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@4.0.11
aliases CVE-2018-11385, GHSA-g4rg-rw65-8hfg
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vyug-krcw-jyef
6
url VCID-x4nv-gvag-7qf2
vulnerability_id VCID-x4nv-gvag-7qf2
summary 
CVE-2016-4423: Large username storage in session
The attemptAuthentication function in `Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php` does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-4423
reference_id
reference_type
scores
0
value 0.01435
scoring_system epss
scoring_elements 0.81062
published_at 2026-06-05T12:55:00Z
1
value 0.01435
scoring_system epss
scoring_elements 0.81034
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-4423
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1902
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1902
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4423
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4423
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-4423.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-4423.yaml
4
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2016-4423.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2016-4423.yaml
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-4423.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-4423.yaml
6
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
7
reference_url https://github.com/symfony/symfony/pull/18733
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/pull/18733
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-4423
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-4423
9
reference_url https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session
10
reference_url http://www.debian.org/security/2016/dsa-3588
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2016/dsa-3588
11
reference_url https://symfony.com/cve-2016-4423
reference_id CVE-2016-4423
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2016-4423
12
reference_url http://symfony.com/blog/cve-2016-4423-large-username-storage-in-session
reference_id CVE-2016-4423-LARGE-USERNAME-STORAGE-IN-SESSION
reference_type
scores
url http://symfony.com/blog/cve-2016-4423-large-username-storage-in-session
fixed_packages
0
url pkg:composer/symfony/security@2.3.41
purl pkg:composer/symfony/security@2.3.41
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ef86-hqv4-6kaz
1
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.3.41
1
url pkg:composer/symfony/security@2.7.13
purl pkg:composer/symfony/security@2.7.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-djnm-e9r4-c3f5
2
vulnerability VCID-dsbx-q641-4fc7
3
vulnerability VCID-ef86-hqv4-6kaz
4
vulnerability VCID-vyug-krcw-jyef
5
vulnerability VCID-x4nv-gvag-7qf2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.7.13
2
url pkg:composer/symfony/security@2.8.6
purl pkg:composer/symfony/security@2.8.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-djnm-e9r4-c3f5
2
vulnerability VCID-dsbx-q641-4fc7
3
vulnerability VCID-ef86-hqv4-6kaz
4
vulnerability VCID-mew1-9shg-mugs
5
vulnerability VCID-p6f7-utd6-eqej
6
vulnerability VCID-uuk9-e5qy-rfgf
7
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.8.6
3
url pkg:composer/symfony/security@3.0.6
purl pkg:composer/symfony/security@3.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-djnm-e9r4-c3f5
2
vulnerability VCID-dsbx-q641-4fc7
3
vulnerability VCID-ef86-hqv4-6kaz
4
vulnerability VCID-mew1-9shg-mugs
5
vulnerability VCID-p6f7-utd6-eqej
6
vulnerability VCID-uuk9-e5qy-rfgf
7
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@3.0.6
aliases CVE-2016-4423, GHSA-whgv-8cg3-7hcm
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-x4nv-gvag-7qf2
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.3.2