CVE-2012-6431 | Vulnerability Database | Aqua Security

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

Affected Software

Name	Vendor	Start Version	End Version
Symfony	Sensiolabs	2.0.0 (including)	2.0.0 (including)
Symfony	Sensiolabs	2.0.1 (including)	2.0.1 (including)
Symfony	Sensiolabs	2.0.2 (including)	2.0.2 (including)
Symfony	Sensiolabs	2.0.3 (including)	2.0.3 (including)
Symfony	Sensiolabs	2.0.4 (including)	2.0.4 (including)
Symfony	Sensiolabs	2.0.5 (including)	2.0.5 (including)
Symfony	Sensiolabs	2.0.6 (including)	2.0.6 (including)
Symfony	Sensiolabs	2.0.7 (including)	2.0.7 (including)
Symfony	Sensiolabs	2.0.8 (including)	2.0.8 (including)
Symfony	Sensiolabs	2.0.9 (including)	2.0.9 (including)
Symfony	Sensiolabs	2.0.10 (including)	2.0.10 (including)
Symfony	Sensiolabs	2.0.11 (including)	2.0.11 (including)
Symfony	Sensiolabs	2.0.12 (including)	2.0.12 (including)
Symfony	Sensiolabs	2.0.13 (including)	2.0.13 (including)
Symfony	Sensiolabs	2.0.14 (including)	2.0.14 (including)
Symfony	Sensiolabs	2.0.15 (including)	2.0.15 (including)
Symfony	Sensiolabs	2.0.16 (including)	2.0.16 (including)
Symfony	Sensiolabs	2.0.17 (including)	2.0.17 (including)
Symfony	Sensiolabs	2.0.18 (including)	2.0.18 (including)
Symfony	Sensiolabs	2.0.19 (including)	2.0.19 (including)

References

http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released

NVD	https://nvd.nist.gov/vuln/detail/CVE-2012-6431
CWE	https://cwe.mitre.org/data/definitions/264.html