CVE-2020-5255

Katalog CVE

CVSS 4.3 · Medium EPSS 1,3%

Kerentanan Improper Interaction Between Multiple Correctly-Behaving Entities pada sensiolabs symfony. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Rincian

Terbit di NVD

30 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-435: Improper Interaction Between Multiple Correctly-Behaving Entities
CWE-20: Improper Input Validation

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6 patch · advisory pihak ketiga
• https://github.com/symfony/symfony/security/advisories/GHSA-mcx4-f5f5-4859 advisory pihak ketiga
• https://symfony.com/blog/cve-2020-5255-prevent-cache-poisoning-via-a-response-content-type-header advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36JLPHUPKDFA...