Search for vulnerabilities
Vulnerability details: VCID-5gjg-vdx2-ykar
Vulnerability ID VCID-5gjg-vdx2-ykar
Aliases CVE-2015-4050
GHSA-qmqw-mpqp-mr54
Summary Symfony Incorrect Access Control FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the `_controller` attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to `/_fragment`. This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-284 Improper Access Control
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual MODERATE http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html
generic_textual MODERATE http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html
generic_textual MODERATE http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html
epss 0.76192 https://api.first.org/data/v1/epss?cve=CVE-2015-4050
generic_textual MODERATE https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2015-4050.yaml
generic_textual MODERATE https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-4050.yaml
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2015-4050
generic_textual MODERATE https://symfony.com/cve-2015-4050
generic_textual MODERATE https://web.archive.org/web/20200228090443/http://www.securityfocus.com/bid/74928
generic_textual MODERATE http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access
generic_textual MODERATE http://www.debian.org/security/2015/dsa-3276
Reference id Reference type URL
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html
https://api.first.org/data/v1/epss?cve=CVE-2015-4050
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4050
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2015-4050.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-4050.yaml
https://nvd.nist.gov/vuln/detail/CVE-2015-4050
https://symfony.com/cve-2015-4050
https://web.archive.org/web/20200228090443/http://www.securityfocus.com/bid/74928
http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access
http://www.debian.org/security/2015/dsa-3276
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.98859
EPSS Score 0.76192
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:28:58.276448+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmqw-mpqp-mr54/GHSA-qmqw-mpqp-mr54.json 36.1.3