CVE-2020-5274

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5

• CWE-209
• CWE-209

• https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45dbPatch, Third Party Advisory
• https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5adPatch, Third Party Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-m884-279h-32v2Third Party Advisory
• https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45dbPatch, Third Party Advisory
• https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5adPatch, Third Party Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-m884-279h-32v2Third Party Advisory

Published

Mar 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5268In Saml2 Authentication Services for ASP.NET versions before…7.3
• CVE-2020-5269In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is…6.1
• CVE-2020-5270In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is…6.1
• CVE-2020-5271In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is…6.1
• CVE-2020-5272In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is…6.1
• CVE-2020-5273In PrestaShop module ps_linklist versions before 3.1.0, ther…5.4
• CVE-2020-5275In symfony/security-http before versions 4.4.7 and 5.0.7, wh…8.1
• CVE-2020-5276In PrestaShop between versions 1.7.1.0 and 1.7.6.5, there is…6.1
• CVE-2020-5277PrestaShop module ps_facetedsearch versions before 3.5.0 has…5.4
• CVE-2020-5278In PrestaShop between versions 1.5.4.0 and 1.7.6.5, there is…6.1
• CVE-2020-5279In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there ar…6.5
• CVE-2020-5280http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a lo…7.5