Denial of Service Vulnerability in Symfony HttpFoundation Component
CVE-2018-11386
5.9MEDIUM
Summary
A denial of service vulnerability exists in the HttpFoundation component of Symfony. The PDOSessionHandler class, which handles session storage via a PDO connection, can be exploited under certain configurations. A malicious actor could craft a specific payload to disrupt service, rendering a Symfony application unresponsive. This issue affects multiple version series of Symfony, highlighting the importance of updating to the most secure and stable releases.
References
CVSS V3.1
Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved