CVE-2026-47212

Katalog CVE

CVSS 5.3 · Medium EPSS 1,5%

Kerentanan Missing Authentication for Critical Function pada sensiolabs symfony. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse() received the configured webhook secret but ignored the X-Twilio-Signature HMAC header, allowing unauthenticated POST requests to inject forged Twilio status payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

15 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/security/advisories/GHSA-55rj-x2vc-4whq patch · advisory vendor
• https://github.com/symfony/symfony/commit/8545fb2af6c07dfb5ef0fc8d9bccf86db2c94356 patch
• https://github.com/symfony/symfony/releases/tag/v6.4.40 product · release notes
• https://github.com/symfony/symfony/releases/tag/v7.4.12 product · release notes
• https://github.com/symfony/symfony/releases/tag/v8.0.12 product · release notes