HOMEVULNERABILITIESCVE-2021-32693
HIGH

CVE-2021-32693

CWE-287Published: June 17, 2021· Updated: Jun 17, 2026

8.8
CVSS v3.1

Official Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the application, in such a situation, a user authenticated on a part of the application could be considered authenticated on the rest of the application. Starting in version 5.3.2, a patch ensures that the authenticated token is only available for the firewall that generates it.

NVD Source

Technical Analysis

CVE-2021-32693 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

sensiolabs1 product(s)
symfony
Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129
PATCHhttps://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728
PATCHhttps://github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrq
PATCHhttps://symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-one
PATCHhttps://github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129
PATCHhttps://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728
PATCHhttps://github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrq
PATCHhttps://symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-one

All References (8)

→
https://github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129Patch · Third Party Advisory
→
https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728Patch · Third Party Advisory
→
https://github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrqPatch · Third Party Advisory
→
https://symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-onePatch · Vendor Advisory
→
https://github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129Patch · Third Party Advisory
→
https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728Patch · Third Party Advisory
→
https://github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrqPatch · Third Party Advisory
→
https://symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-onePatch · Vendor Advisory

Quick Facts

CVE IDCVE-2021-32693
CVSS Score8.8 / 10
SeverityHIGH
WeaknessCWE-287
CISA KEVNo
Affected1 vendor(s)
PublishedJun 17, 2021

Related CVEs (CWE-287)

CVE-2008-6916
10.0
CVE-2013-7282
10.0
CVE-2008-1262
10.0
CVE-2008-1244
10.0
CVE-2010-4232
10.0
CVE-2011-1519
10.0

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2021-32693 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2021-32693·NVD