CVE-2021-21424

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200CWE-203

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-214259.8Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlieCVE-2021-214269.8Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and pCVE-2021-214277.2Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 andCVE-2021-214287.0Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuraCVE-2021-214293.3OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI SpCVE-2021-214305.5OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically giCVE-2021-214318.1sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of theCVE-2021-214326.5Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in CVE-2021-214338.8Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 woCVE-2021-214344.8Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. another agent who wantsCVE-2021-214356.5Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface. This issue affectsCVE-2021-214364.3Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsI
CVE-2021-21424: Medium severity, CVSS 5.3 | Vulnix