CyberRota Analysis
AI-GeneratedThe vulnerability affects Symfony versions 5.4.46 to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, allowing attackers to manipulate the application environment by exploiting discrepancies between the parsed query string and server arguments. This can lead to unauthorized changes in application behavior, potentially exposing sensitive information or enabling further attacks. Organizations using these versions of Symfony should prioritize updating to the patched versions to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Related CVEs
Other vulnerabilities affecting the same vendor(s)