CyberRota Analysis
AI-GeneratedThe DefaultAuthenticationFailureHandler in Symfony prior to specified versions is vulnerable to an issue where it improperly handles the _failure_path parameter, allowing unauthenticated users to access protected routes via subrequests when failure_forward is enabled. This could lead to unauthorized access to sensitive information or functionality. Organizations using affected versions of Symfony should prioritize patching to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Related CVEs
Other vulnerabilities affecting the same vendor(s)