VulnerableCode Package Details - pkg:composer/symfony/security-http@4.2.0

Search for packages

Advisory	Summary	Fixed in package version
GHSA-4vpc-5jx4-cfqg Aliases: CVE-2019-18886	User enumeration leak using switch user functionality in Symfony An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 …	4.2.12 Vulnerable
GHSA-7q22-x757-cmgc Aliases: CVE-2024-36611	Withdrawn Advisory: Symfony http-security has authentication bypass ## Withdrawn Advisory This advisory has been withdrawn because the report is not …	7.1.0 Vulnerable
GHSA-6h46-9jf5-q59x Aliases: CVE-2026-48489	Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes ### Description When a firewall is configured …	5.4.53 Vulnerable
GHSA-ph86-p8f6-f9r2 Aliases: CVE-2026-45063	Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator ### Description `X509Authenticator` implements client-certificate (mTLS) authentication: the web …	5.4.52 Vulnerable
CVE-2021-21424 Aliases: GHSA-5pv8-ppvj-4h68	Information Exposure Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The …	5.2.8 Vulnerable 4.4.24 Vulnerable
CVE-2019-18886	Information Exposure The ability to enumerate users was possible due to different handling depending on whether the user existed when …	4.3.8 Vulnerable
CVE-2019-10911	Improper Authentication In Symfony, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user …	2.7.51 Vulnerable 2.8.50 Vulnerable 3.4.26 Vulnerable 4.2.7 Vulnerable
GHSA-89r2-5g34-2g47 Aliases: CVE-2018-19790	Symfony Open Redirect An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x …	4.2.1 Vulnerable 4.2.1 Vulnerable
GHSA-cchx-mfrc-fwqr Aliases: CVE-2019-10911	Improper authentication in Symfony In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before …	4.2.7 Vulnerable 4.2.7 Vulnerable
CVE-2023-46734 Aliases: GHSA-q847-2q57-wmr3	Cross-site scripting Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting …	5.4.31 Vulnerable 6.3.8 Vulnerable 5.4.31 Vulnerable 6.3.8 Vulnerable

Advisory

Summary

Fixed in package version

GHSA-4vpc-5jx4-cfqg
Aliases:
CVE-2019-18886

User enumeration leak using switch user functionality in Symfony An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 …

4.2.12
Vulnerable

GHSA-7q22-x757-cmgc
Aliases:
CVE-2024-36611

Withdrawn Advisory: Symfony http-security has authentication bypass ## Withdrawn Advisory This advisory has been withdrawn because the report is not …

7.1.0
Vulnerable

GHSA-6h46-9jf5-q59x
Aliases:
CVE-2026-48489

Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes ### Description When a firewall is configured …

5.4.53
Vulnerable

GHSA-ph86-p8f6-f9r2
Aliases:
CVE-2026-45063

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator ### Description `X509Authenticator` implements client-certificate (mTLS) authentication: the web …

5.4.52
Vulnerable

CVE-2021-21424
Aliases:
GHSA-5pv8-ppvj-4h68

Information Exposure Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The …

5.2.8
Vulnerable

4.4.24
Vulnerable

CVE-2019-18886

Information Exposure The ability to enumerate users was possible due to different handling depending on whether the user existed when …

4.3.8
Vulnerable

CVE-2019-10911

Improper Authentication In Symfony, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user …

2.7.51
Vulnerable

2.8.50
Vulnerable

3.4.26
Vulnerable

4.2.7
Vulnerable

GHSA-89r2-5g34-2g47
Aliases:
CVE-2018-19790

Symfony Open Redirect An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x …

4.2.1
Vulnerable

GHSA-cchx-mfrc-fwqr
Aliases:
CVE-2019-10911

Improper authentication in Symfony In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before …

4.2.7
Vulnerable

CVE-2023-46734
Aliases:
GHSA-q847-2q57-wmr3

Cross-site scripting Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting …

5.4.31
Vulnerable

6.3.8
Vulnerable

5.4.31
Vulnerable

6.3.8
Vulnerable

Next non-vulnerable version	7.4.13
Latest non-vulnerable version	8.0.13
Risk score	3.9