CVE-2015-4050
Estado: ModificadaMedia (4.3)—💥 Exploit
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 8.21%
- Percentil entre todas las CVEs puntuadas: 95
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Plantilla de Nuclei (detección automática y masiva) · Symfony - Authentication Bypass
Tecnologías afectadas (1)
CWE
- CWE-284
Referencias
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html
- http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access
- http://www.debian.org/security/2015/dsa-3276
- http://www.securityfocus.com/bid/74928
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html
- http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access
- http://www.debian.org/security/2015/dsa-3276
- http://www.securityfocus.com/bid/74928
JSON original (NVD)
Mostrar
{
"id": "CVE-2015-4050",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2015-06-02T14:59:12.253",
"references": [
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html",
"source": "cve@mitre.org"
},
{
"url": "http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2015/dsa-3276",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/74928",
"source": "cve@mitre.org"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.debian.org/security/2015/dsa-3276",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/74928",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment."
},
{
"lang": "es",
"value": "FragmentListener en el componente HttpKernel en Symfony 2.3.19 hasta 2.3.28, 2.4.9 hasta 2.4.10, 2.5.4 hasta 2.5.11, y 2.6.0 hasta 2.6.7, cuando ek soporte ESI o SSI está habilitado, no comprueba si el atributo _controller esta configurado, lo que permite a atacantes remotos evadir la firma de URLs y las reglas de seguridad mediante la inclusión de (1) ningún hash o (2) un hash inválido en una solicitud a /_fragment."
}
],
"lastModified": "2026-06-17T00:26:41.657",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.19:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5B629031-7AC2-4918-9FEC-C9D26EBB0161"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.20:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "397E0404-9856-45C1-B12D-058E84F3FA3C"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2EC987B-3C4D-4575-9BC8-9AFB794A20E7"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE17FB48-06AA-4275-9F3A-0CF008C9C86B"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.23:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39F81F64-CCF2-4CB1-9504-153267839BEE"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.24:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B1244EA-78F7-4501-9E42-52C77CE37963"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.25:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CBCD0661-41FA-4F89-A1D8-C50BE232D36D"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.26:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1AC87263-68E3-4BF8-8ED7-C40CC2F8CE2A"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.27:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51A66842-7423-49F0-9FD3-64B7DE146F30"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.3.28:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "68CBB5C6-C707-43E9-AFC5-467E376D9218"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.4.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3FE35E75-315C-472B-B8C3-4E9AF9C5421F"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.4.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "360EFC8C-6FD2-48B1-A3E9-C16867B05F17"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.5.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97E35964-8D47-4146-AF91-C5EC0A8E1801"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.5.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "01076190-7FDF-4A9C-99C9-A1F153BFFA09"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.5.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D6EBF05-F0C6-4B36-8B5E-BF1793364AE8"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.5.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0FE1BB71-C1E8-4957-B5A6-E7B24A3FEC76"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.5.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD415B94-A1DA-4483-8F39-56BDF805A7DA"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.5.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4EAC5594-43BE-4DA4-9420-C070F6C5C77C"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.5.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BFCA2A46-50CD-4C31-836C-F9D922810D3D"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.5.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EAA905B-96B5-41AF-A732-530666DE3D68"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F13A190-1F97-4D7B-826A-E976934AE82B"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27770F28-584A-48E1-B885-6C6D17F546ED"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C177DF32-F356-483C-82E5-8FCC68D89A74"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C6D9461C-A049-48EC-BB3E-FD3212C82795"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F7EF330-714D-42E4-A2CF-406B84F3945B"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D86A4FF-9BD2-4B3D-A2CE-E9200A4EC690"
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:2.6.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D6667BA-5A82-480B-AD9B-0E4CD0188458"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}