CVE-2020-5274

Katalog CVE

CVSS 5.4 · Medium EPSS 1,2%

Kerentanan Generation of Error Message Containing Sensitive Information pada sensiolabs symfony. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5

Rincian

Terbit di NVD

30 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45db patch · advisory pihak ketiga
• https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5ad patch · advisory pihak ketiga
• https://github.com/symfony/symfony/security/advisories/GHSA-m884-279h-32v2 advisory pihak ketiga