Read the docs
TI-2015-06750 Aliases CVE-2015-8125GHSA-g97c-jfx6-xvxh

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow…

Priority LOW 38CWE-208Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-208.

Summary

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Why it matters now

EPSS 0.02545 85th percentileScored 2026-11-07
Fix Fixed symfony/symfony (Packagist): 2.3.35, 2.7.7, 2.6.12symfony/form (Packagist): 2.3.35, 2.6.12, 2.7.7+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—symfony/symfony (Packagist)2.3.0 to before 2.3.352.3.35Patch availableGHSA-g97c-jfx6-xvxh
—symfony/symfony (Packagist)2.7.0 to before 2.7.72.7.7Patch availableGHSA-g97c-jfx6-xvxh
—symfony/form (Packagist)2.3.0 to before 2.3.352.3.35Patch availableGHSA-g97c-jfx6-xvxh
—symfony/form (Packagist)2.4.0 to before 2.6.122.6.12Patch availableGHSA-g97c-jfx6-xvxh
—symfony/form (Packagist)2.7.0 to before 2.7.72.7.7Patch availableGHSA-g97c-jfx6-xvxh
—symfony/security-http (Packagist)2.4.0 to before 2.6.122.6.12Patch availableGHSA-g97c-jfx6-xvxh
—symfony/security-http (Packagist)2.7.0 to before 2.7.72.7.7Patch availableGHSA-g97c-jfx6-xvxh
—symfony/security (Packagist)2.3.0 to before 2.3.352.3.35Patch availableGHSA-g97c-jfx6-xvxh
—symfony/security (Packagist)2.4.0 to before 2.6.122.6.12Patch availableGHSA-g97c-jfx6-xvxh
—symfony/security (Packagist)2.7.0 to before 2.7.72.7.7Patch availableGHSA-g97c-jfx6-xvxh
—symfony/symfony (Packagist)2.4.0 to before 2.6.122.6.12Patch availableGHSA-g97c-jfx6-xvxh
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • symfony/symfony (Packagist) Vendor— Affected 2.3.0 to before 2.3.35 Fixed in 2.3.35 Patch available GHSA-g97c-jfx6-xvxh
  • symfony/symfony (Packagist) Vendor— Affected 2.7.0 to before 2.7.7 Fixed in 2.7.7 Patch available GHSA-g97c-jfx6-xvxh
  • symfony/form (Packagist) Vendor— Affected 2.3.0 to before 2.3.35 Fixed in 2.3.35 Patch available GHSA-g97c-jfx6-xvxh
  • symfony/form (Packagist) Vendor— Affected 2.4.0 to before 2.6.12 Fixed in 2.6.12 Patch available GHSA-g97c-jfx6-xvxh
  • symfony/form (Packagist) Vendor— Affected 2.7.0 to before 2.7.7 Fixed in 2.7.7 Patch available GHSA-g97c-jfx6-xvxh
  • symfony/security-http (Packagist) Vendor— Affected 2.4.0 to before 2.6.12 Fixed in 2.6.12 Patch available GHSA-g97c-jfx6-xvxh
  • symfony/security-http (Packagist) Vendor— Affected 2.7.0 to before 2.7.7 Fixed in 2.7.7 Patch available GHSA-g97c-jfx6-xvxh
  • symfony/security (Packagist) Vendor— Affected 2.3.0 to before 2.3.35 Fixed in 2.3.35 Patch available GHSA-g97c-jfx6-xvxh
  • symfony/security (Packagist) Vendor— Affected 2.4.0 to before 2.6.12 Fixed in 2.6.12 Patch available GHSA-g97c-jfx6-xvxh
  • symfony/security (Packagist) Vendor— Affected 2.7.0 to before 2.7.7 Fixed in 2.7.7 Patch available GHSA-g97c-jfx6-xvxh
  • symfony/symfony (Packagist) Vendor— Affected 2.4.0 to before 2.6.12 Fixed in 2.6.12 Patch available GHSA-g97c-jfx6-xvxh

CPE configurations NVD · 54

CPEVersionsRoleVendor
cpe:2.3:a:sensiolabs:symfony:2.3.0:*:*:*:*:*:*:*2.3.0Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.1:*:*:*:*:*:*:*2.3.1Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.2:*:*:*:*:*:*:*2.3.2Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.3:*:*:*:*:*:*:*2.3.3Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.4:*:*:*:*:*:*:*2.3.4Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.5:*:*:*:*:*:*:*2.3.5Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.6:*:*:*:*:*:*:*2.3.6Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.7:*:*:*:*:*:*:*2.3.7Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.8:*:*:*:*:*:*:*2.3.8Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.9:*:*:*:*:*:*:*2.3.9Vulnerablesensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.5:*:*:*:*:*:*:* Versions 2.3.5 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.6:*:*:*:*:*:*:* Versions 2.3.6 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.8:*:*:*:*:*:*:* Versions 2.3.8 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.9:*:*:*:*:*:*:* Versions 2.3.9 Vulnerable ·sensiolabs
Show 44 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sensiolabs:symfony:2.3.10:*:*:*:*:*:*:*2.3.10Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.11:*:*:*:*:*:*:*2.3.11Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.12:*:*:*:*:*:*:*2.3.12Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.13:*:*:*:*:*:*:*2.3.13Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.14:*:*:*:*:*:*:*2.3.14Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.15:*:*:*:*:*:*:*2.3.15Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.16:*:*:*:*:*:*:*2.3.16Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.17:*:*:*:*:*:*:*2.3.17Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.18:*:*:*:*:*:*:*2.3.18Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.19:*:*:*:*:*:*:*2.3.19Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.20:*:*:*:*:*:*:*2.3.20Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.21:*:*:*:*:*:*:*2.3.21Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.22:*:*:*:*:*:*:*2.3.22Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.23:*:*:*:*:*:*:*2.3.23Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.24:*:*:*:*:*:*:*2.3.24Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.25:*:*:*:*:*:*:*2.3.25Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.26:*:*:*:*:*:*:*2.3.26Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.27:*:*:*:*:*:*:*2.3.27Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.28:*:*:*:*:*:*:*2.3.28Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.29:*:*:*:*:*:*:*2.3.29Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.30:*:*:*:*:*:*:*2.3.30Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.31:*:*:*:*:*:*:*2.3.31Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.32:*:*:*:*:*:*:*2.3.32Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.33:*:*:*:*:*:*:*2.3.33Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.3.34:*:*:*:*:*:*:*2.3.34Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.0:*:*:*:*:*:*:*2.6.0Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.1:*:*:*:*:*:*:*2.6.1Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.2:*:*:*:*:*:*:*2.6.2Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.3:*:*:*:*:*:*:*2.6.3Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.4:*:*:*:*:*:*:*2.6.4Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.5:*:*:*:*:*:*:*2.6.5Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.6:*:*:*:*:*:*:*2.6.6Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.7:*:*:*:*:*:*:*2.6.7Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.8:*:*:*:*:*:*:*2.6.8Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.9:*:*:*:*:*:*:*2.6.9Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.10:*:*:*:*:*:*:*2.6.10Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.6.11:*:*:*:*:*:*:*2.6.11Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.7.0:*:*:*:*:*:*:*2.7.0Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.7.1:*:*:*:*:*:*:*2.7.1Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.7.2:*:*:*:*:*:*:*2.7.2Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.7.3:*:*:*:*:*:*:*2.7.3Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.7.4:*:*:*:*:*:*:*2.7.4Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.7.5:*:*:*:*:*:*:*2.7.5Vulnerablesensiolabs
cpe:2.3:a:sensiolabs:symfony:2.7.6:*:*:*:*:*:*:*2.7.6Vulnerablesensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.10:*:*:*:*:*:*:* Versions 2.3.10 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.11:*:*:*:*:*:*:* Versions 2.3.11 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.13:*:*:*:*:*:*:* Versions 2.3.13 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.14:*:*:*:*:*:*:* Versions 2.3.14 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.15:*:*:*:*:*:*:* Versions 2.3.15 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.16:*:*:*:*:*:*:* Versions 2.3.16 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.17:*:*:*:*:*:*:* Versions 2.3.17 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.18:*:*:*:*:*:*:* Versions 2.3.18 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.19:*:*:*:*:*:*:* Versions 2.3.19 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.20:*:*:*:*:*:*:* Versions 2.3.20 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.21:*:*:*:*:*:*:* Versions 2.3.21 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.22:*:*:*:*:*:*:* Versions 2.3.22 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.23:*:*:*:*:*:*:* Versions 2.3.23 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.24:*:*:*:*:*:*:* Versions 2.3.24 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.25:*:*:*:*:*:*:* Versions 2.3.25 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.26:*:*:*:*:*:*:* Versions 2.3.26 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.27:*:*:*:*:*:*:* Versions 2.3.27 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.28:*:*:*:*:*:*:* Versions 2.3.28 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.29:*:*:*:*:*:*:* Versions 2.3.29 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.30:*:*:*:*:*:*:* Versions 2.3.30 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.31:*:*:*:*:*:*:* Versions 2.3.31 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.32:*:*:*:*:*:*:* Versions 2.3.32 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.33:*:*:*:*:*:*:* Versions 2.3.33 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.3.34:*:*:*:*:*:*:* Versions 2.3.34 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.3:*:*:*:*:*:*:* Versions 2.6.3 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.4:*:*:*:*:*:*:* Versions 2.6.4 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.5:*:*:*:*:*:*:* Versions 2.6.5 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.6:*:*:*:*:*:*:* Versions 2.6.6 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.7:*:*:*:*:*:*:* Versions 2.6.7 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.8:*:*:*:*:*:*:* Versions 2.6.8 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.9:*:*:*:*:*:*:* Versions 2.6.9 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.10:*:*:*:*:*:*:* Versions 2.6.10 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.6.11:*:*:*:*:*:*:* Versions 2.6.11 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.7.5:*:*:*:*:*:*:* Versions 2.7.5 Vulnerable ·sensiolabs
  • cpe:2.3:a:sensiolabs:symfony:2.7.6:*:*:*:*:*:*:* Versions 2.7.6 Vulnerable ·sensiolabs

Remediation

  • Fix · GHSA-g97c-jfx6-xvxh symfony/symfony (Packagist) Fixed in 2.3.35 Advisory →
  • Fix · GHSA-g97c-jfx6-xvxh symfony/symfony (Packagist) Fixed in 2.7.7 Advisory →
  • Fix · GHSA-g97c-jfx6-xvxh symfony/form (Packagist) Fixed in 2.3.35 Advisory →
  • Fix · GHSA-g97c-jfx6-xvxh symfony/form (Packagist) Fixed in 2.6.12 Advisory →
  • Fix · GHSA-g97c-jfx6-xvxh symfony/form (Packagist) Fixed in 2.7.7 Advisory →
  • Fix · GHSA-g97c-jfx6-xvxh symfony/security-http (Packagist) Fixed in 2.6.12 Advisory →
  • Fix · GHSA-g97c-jfx6-xvxh symfony/security-http (Packagist) Fixed in 2.7.7 Advisory →
  • Fix · GHSA-g97c-jfx6-xvxh symfony/security (Packagist) Fixed in 2.3.35 Advisory →
  • Fix · GHSA-g97c-jfx6-xvxh symfony/security (Packagist) Fixed in 2.6.12 Advisory →
  • Fix · GHSA-g97c-jfx6-xvxh symfony/security (Packagist) Fixed in 2.7.7 Advisory →
  • Fix · GHSA-g97c-jfx6-xvxh symfony/symfony (Packagist) Fixed in 2.6.12 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-8125
  2. 2026-10-03 Alias added: GHSA-g97c-jfx6-xvxh

References

Patch 1

Advisory 4

Other 7

  • TI-2019-13616 An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0… CVSS 3.1CRITICAL 9.8
  • TI-2018-10604 An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through… CVSS 3.1MEDIUM 6.5
  • TI-2019-08131 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and… CVSS 3.1CRITICAL 9.8
  • TI-2016-02159 Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass… CVSS 3.0CRITICAL 9.8
  • TI-2019-08459 An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. CVSS 3.1CRITICAL 9.8
  • TI-2018-08136 An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x… CVSS 3.0CRITICAL 9.8
See all 88 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences