RCE in Sensiolabs Symfony
CVE-2015-2308
Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.014 (69.0th percentile) — read the EPSS interpretation.
Affected products
- Sensiolabs Symfony — versions 2.0.0, 2.0.1, 2.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (x_refsource_JVNDB, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_JVN, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_BID)