CVE-2015-2308

Symfony 2.x < 2.3.27, 2.4.x-2.5.x < 2.5.11, 2.6.x < 2.6.6 - Remote Code Execution via HttpCache ESI Language Attribute

Title source: llm
STIX 2.1

Description

Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.

References (4)

Core 4
Core References
Patch, Vendor Advisory x_refsource_confirm
https://symfony.com/blog/cve-2015-2308-esi-code-injection
Vendor Advisory third-party-advisory x_refsource_jvndb
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000089
Vendor Advisory third-party-advisory x_refsource_jvn
http://jvn.jp/en/jp/JVN19578958/index.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/75357

Scores

EPSS 0.0137
EPSS Percentile 68.4%

Details

CWE
CWE-94
Status published
Products (50)
sensiolabs/symfony 2.0.0
sensiolabs/symfony 2.0.1
sensiolabs/symfony 2.0.2
sensiolabs/symfony 2.0.3
sensiolabs/symfony 2.0.4
sensiolabs/symfony 2.0.5
sensiolabs/symfony 2.0.6
sensiolabs/symfony 2.0.7
sensiolabs/symfony 2.0.8
sensiolabs/symfony 2.0.9
... and 40 more
Published Jun 24, 2015
Tracked Since Feb 18, 2026