CVE-2012-6431

MediumCVSS 6.4/10Last modified Jun 16, 2026

Description

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-releasedVendor Advisory
http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-releasedVendor Advisory

Timeline

Published: Dec 27, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-64326.8Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to CVE-2012-64336.8Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authenticatio CVE-2012-64346.8Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the aut CVE-2012-64357.5When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/CVE-2012-64367.5The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port CVE-2012-64379.8The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet ca CVE-2012-64387.5The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port CVE-2012-64398.5When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 4481 CVE-2012-64404.8The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of CVE-2012-64415.0An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2 CVE-2012-64427.5When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/CVE-2012-64474.3Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 5.0.0 through 5.0.2 allows remote attackers to inject arbitrary web script