CVE-2012-6431

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
sensiolabssymfony
2.0.0
sensiolabssymfony
2.0.1
sensiolabssymfony
2.0.2
sensiolabssymfony
2.0.3
sensiolabssymfony
2.0.4
sensiolabssymfony
2.0.5
sensiolabssymfony
2.0.6
sensiolabssymfony
2.0.7
sensiolabssymfony
2.0.8
sensiolabssymfony
2.0.9
sensiolabssymfony
2.0.10
sensiolabssymfony
2.0.11
sensiolabssymfony
2.0.12
sensiolabssymfony
2.0.13
sensiolabssymfony
2.0.14
sensiolabssymfony
2.0.15
sensiolabssymfony
2.0.16
sensiolabssymfony
2.0.17
sensiolabssymfony
2.0.18
sensiolabssymfony
2.0.19
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released
http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released