Unscored severity · published Dec 27, 2012
CVE-2012-6431
Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Symfony · Sensiolabs
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +14 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6431
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6431
Vendor Advisory
http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released
More from Symfony
9.8
CVE-2026-47767
Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
9.8
CVE-2024-51736
Command execution hijack on Windows with Process class in symfony/process
9.8
CVE-2019-18889
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7
9.8
CVE-2019-11325
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8
9.8
CVE-2017-11365
Certain Symfony products are affected by: Incorrect Access Control