Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/symfony/http-kernel@2.3.9
purl pkg:composer/symfony/http-kernel@2.3.9
Next non-vulnerable version 4.4.50
Latest non-vulnerable version 8.0.12
Risk score 3.6
Vulnerabilities affecting this package (6)
Advisory Summary Fixed in package version
GHSA-5c58-w9xc-qcj9
Aliases:
CVE-2015-2308
Symfony Vulnerable to PHP Eval Injection Applications with ESI support (and SSI support as of Symfony 2.6) enabled and using …
2.3.27
Vulnerable
GHSA-q8hg-pf8v-cxrv
Aliases:
CVE-2019-18887
Symfony Http-Kernel has non-constant time comparison in UriSigner When checking the signature of an URI (an ESI fragment URL for …
2.8.52
Vulnerable
GHSA-wvjv-p5rr-mmqm
Aliases:
CVE-2014-5245
Symfony allows direct access of ESI URLs behind a trusted proxy All 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the …
2.3.19
Vulnerable
GHSA-h7vf-5wrv-9fhv
Aliases:
CVE-2022-24894
GMS-2023-209
Symfony storing cookie headers in HttpCache Description ----------- The Symfony HTTP cache system acts as a reverse proxy: it caches …
4.4.50
Not vulnerable
CVE-2015-2308

Esi Code Injection Applications with ESI support (and SSI support as of Symfony ) enabled and using the Symfony built-in …
2.3.27
Vulnerable
2.5.11
Vulnerable
2.6.6
Vulnerable
CVE-2014-5245

Improper Access Control Direct access of ESI URLs behind a trusted proxy.
2.5.4
Vulnerable
2.4.9
Vulnerable
This package is not known to fix any advisories.