CVE-2020-5255

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-435 CWE-20

Affected software

Vendor	Product	Versions
symfony	symfony	>= 4.4.0 and < 4.4.7; >= 5.0.0 and < 5.0.7

References

https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6Patch, Third Party Advisory
https://github.com/symfony/symfony/security/advisories/GHSA-mcx4-f5f5-4859Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ/
https://symfony.com/blog/cve-2020-5255-prevent-cache-poisoning-via-a-response-content-type-headerThird Party Advisory
https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6Patch, Third Party Advisory
https://github.com/symfony/symfony/security/advisories/GHSA-mcx4-f5f5-4859Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ/
https://symfony.com/blog/cve-2020-5255-prevent-cache-poisoning-via-a-response-content-type-headerThird Party Advisory

Timeline

Published: Mar 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-52568.8BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow th CVE-2020-52578.1In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before CVE-2020-52587.7In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the abil CVE-2020-52598.6In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the abilit CVE-2020-52607.5Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacke CVE-2020-52616.8Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty impl CVE-2020-52625.5In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new CVE-2020-52634.9auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication)CVE-2020-52646.1In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page. It allows anyone to execute arbi CVE-2020-52656.1In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminAttributesGroups page. The problem is patched in 1.7.6.CVE-2020-52665.4In the ps_link module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title fi CVE-2020-52674.8In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers.