CVE-2020-15094

Katalog CVE

CVSS 8.8 · High EPSS 3,0%

Kerentanan Improper Removal of Sensitive Information Before Storage or Transfer pada sensiolabs httpclient, sensiolabs symfony +1 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.

Rincian

Terbit di NVD

2 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

EPSS (30 hari)

3,0% peluang dieksploitasi; lebih tinggi dari 87,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78 patch · advisory pihak ketiga
• https://github.com/symfony/symfony/security/advisories/GHSA-754h-5r27-7x3r advisory pihak ketiga
• https://packagist.org/packages/symfony/http-kernel product · advisory pihak ketiga
• https://packagist.org/packages/symfony/symfony product · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNGUWOEETOFVH...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAQJXAKWPMWB7...