CVE-2017-11365 Symfony Incorrect Access Control
Remote attackers can bypass access controls in the Symfony password validator component due to incorrect access control implementation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-11365?
CVE-2017-11365 is a critical missing authorization vulnerability in Sensiolabs Symfony, published on 23 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.
Weakness: CWE-284
Which versions are affected by CVE-2017-11365?
24 open source packages ship an affected version, including symfony/security, symfony/security-core and symfony/symfony. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/security Packagist | From 2.7.30 | 2.7.32 |
symfony/security Packagist | From 2.7.30 | 2.7.32 |
symfony/security Packagist | From 2.8.23 | 2.8.25 |
symfony/security Packagist | From 2.8.23 | 2.8.25 |
symfony/security Packagist | From 3.2.10 | 3.2.12 |
symfony/security Packagist | From 3.2.10 | 3.2.12 |
18 more packages
symfony/security Packagist | From 3.3.3 | 3.3.5 |
symfony/security Packagist | From 3.3.3 | 3.3.5 |
symfony/security-core Packagist | From 2.7.30 | 2.7.32 |
symfony/security-core Packagist | From 2.7.30 | 2.7.32 |
symfony/security-core Packagist | From 2.8.23 | 2.8.25 |
symfony/security-core Packagist | From 2.8.23 | 2.8.25 |
symfony/security-core Packagist | From 3.2.10 | 3.2.12 |
symfony/security-core Packagist | From 3.2.10 | 3.2.12 |
symfony/security-core Packagist | From 3.3.3 | 3.3.5 |
symfony/security-core Packagist | From 3.3.3 | 3.3.5 |
symfony/symfony Packagist | From 2.7.30 | 2.7.32 |
symfony/symfony Packagist | From 2.7.30 | 2.7.32 |
symfony/symfony Packagist | From 2.8.23 | 2.8.25 |
symfony/symfony Packagist | From 2.8.23 | 2.8.25 |
symfony/symfony Packagist | From 3.2.10 | 3.2.12 |
symfony/symfony Packagist | From 3.2.10 | 3.2.12 |
symfony/symfony Packagist | From 3.3.3 | 3.3.5 |
symfony/symfony Packagist | From 3.3.3 | 3.3.5 |
Products include Sensiolabs Symfony.
How do I fix CVE-2017-11365?
Upgrade symfony/security to a fixed version for your release line: 2.7.32, 2.8.25, 3.2.12 or 3.3.5.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-11365 being exploited?
There is no known exploitation of CVE-2017-11365 in the wild and no public exploit code.
Other vulnerabilities in Sensiolabs Symfony
- CVE-2019-11325 Improper Input Validation in Symfony
- CVE-2019-10913 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
- CVE-2018-11407 Symfony Authentication Bypass
- CVE-2016-2403 Symfony Authentication Bypass
- CVE-2026-45063 Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
Sources
Also known as GHSA-q87v-q8fw-gmj5.