1. Home
  2. CVE Database
  3. CVE-2021-21424
MEDIUM · 5.3

CVE-2021-21424

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling dep...

Vulnerability Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
SensiolabsSymfony>= 2.8.0, < 3.4.48
FedoraprojectFedora33

Related Weaknesses (CWE)

CWE-200CWE-203

References

FAQ

What is CVE-2021-21424?

CVE-2021-21424 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling dep...

How severe is CVE-2021-21424?

CVE-2021-21424 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-21424?

Check the references section above for vendor advisories and patch information. Affected products include: Sensiolabs Symfony, Fedoraproject Fedora.