Home > Vulnerability Database > CVE-2024-50342

Mend.io Vulnerability Database

CVE-2024-50342

Date: November 6, 2024

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the "NoPrivateNetworkHttpClient", some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the "NoPrivateNetworkHttpClient" now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Language: PHP

Severity Score

3.1

Related Resources (9)

Url: https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-client/CVE-2024-50342.yaml

Url: https://github.com/symfony/symfony

Url: https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50342.yaml

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-50342

Url: https://security-tracker.debian.org/tracker/CVE-2024-50342

Url: https://symfony.com/cve-2024-50342

Url: https://github.com/symfony/symfony/security/advisories/GHSA-9c3x-r3wp-mgxm

Url: https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b

Url: https://www.mend.io/vulnerability-database/CVE-2024-50342

Severity Score

3.1

Weakness Type (CWE)

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

CVSS v3.1

Base Score:	3.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

Mend.io Vulnerability Database

We found results for “”

CVE-2024-50342

Date: November 6, 2024

Language: PHP

Severity Score

Related Resources (9)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?