What’s Vulnerable › Vulnerabilities

CVE-2012-6432

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-12-27 · updated 2026-06-16
• Weakness: CWE-264

Description

Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.

Affected products

• symfony: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 (+20)

References

• http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released
• http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released

Get alerted when CVE-2012-6432 or the next vulnerability affects your stack