CVE-2015-10012 json
sumocoders FrameworkUserBundle login.html.twig information exposure
published 3y ago modified 4mo ago also GHSA-6m7c-45ff-3328 , EUVD-2023-0367
- cvss
- 3.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Resources/views/Security/login.html.twig. The manipulation leads to information exposure through error message. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is abe4993390ba9bd7821ab12678270556645f94c8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217268. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Patch / fix
- packagist sumocoders/framework-user-bundle 1.4.0
- sumocoders frameworkuserbundle 1.4.0
Is CVE-2015-10012 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.0 | 3.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 2.7 | AV:A/AC:L/Au:S/C:P/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | sumocoders/framework-user-bundle | <1.4.0 |
1.4.0 |
Affected products
- sumocoders FrameworkUserBundle
Classification
- Weakness
-
- CWE-209 Generation of Error Message Containing Sensitive Information
References
-
github.com
/sumocoders/FrameworkUserBundle/commit/abe4993390ba9bd7821ab12678270556645f94c8
patch, web, third-party-advisory
-
github.com
/sumocoders/FrameworkUserBundle/releases/tag/v1.4.0
patch, web, third-party-advisory
-
vuldb.com
/?id.217268
vdb-entry, technical-description, web, permissions-required, third-party-advisory
-
vuldb.com
/?ctiid.217268
signature, permissions-required, web, third-party-advisory, vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2015-10012
advisory
-
github.com
/sumocoders/FrameworkUserBundle
package
Sources
- CVE List CVE-2015-10012
- GitHub Advisory GHSA-6m7c-45ff-3328
- NVD CVE-2015-10012
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.