CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2019-10909
https://notcve.org/view.php?id=CVE-2019-10909
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle. En Symfony anterior de la versión 2.7.51, versión 2.8.x anterior de 2.8.50, versión 3.x anterior de 3.4.26, versión 4.x anterior de 4.1.12 y versión 4.2.x anterior de 4.2.7, los mensajes de validación no son evadidos, lo que puede llevar a una vulnerabilidad de XSS cuando una entrada del usuario sea incluida. Esto está relacionado con symfony/framework-bundle • https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2 https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine https://www.drupal.org/sa-core-2019-005 https://www.synology.com/security/advisory/Synology_SA_19_19 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-19790
https://notcve.org/view.php?id=CVE-2018-19790
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login. Se ha descubierto una redirección abierta en Symfony en versiones 2.7.x anteriores a la 2.7.50, versiones 2.8.x anteriores a la 2.8.49, versiones 3.x anteriores a la 3.4.20, versiones 4.0.x anteriores a la 4.0.15, versiones 4.1.x anteriores a la 4.1.9 y versiones 4.2.x anteriores a la 4.2.1. Mediante el uso de barras invertidas en el campo de entrada "_failure_path" de los formularios de inicio de sesión, un atacante puede sortear las restricciones de destino de redirección y redirigir de forma efectiva al usuario a cualquier dominio una vez ha iniciado sesión. • http://www.securityfocus.com/bid/106249 https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ https://seclists.org/bugtraq/2019/May/21 https://sym • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.3EPSS: 1%CPEs: 7EXPL: 0CVE-2018-19789
https://notcve.org/view.php?id=CVE-2018-19789
An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution. Se ha descubierto un problema en Symfony en versiones 2.7.x anteriores a la 2.7.50, versiones 2.8.x anteriores a la 2.8.49, versiones 3.x anteriores a la 3.4.20, versiones 4.0.x anteriores a la 4.0.15, versiones 4.1.x anteriores a la 4.1.9 y versiones 4.2.x anteriores a la 4.2.1. • http://www.securityfocus.com/bid/106249 https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ https://seclists.org/bugtraq/2019/May/21 https://sym • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0CVE-2017-16653
https://notcve.org/view.php?id=CVE-2017-16653
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks. Se ha descubierto un problema en Symfony en versiones anteriores a la 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5 y 4.0-BETA5. La implementación actual de la protección CSRF en Symfony (versiones a partir de la 2) no emplea tokens diferentes para HTTP y HTTPS; por lo tanto, el token es vulnerable a ataques Man-in-the-Middle (MitM) en HTTP y puede emplearse en un contexto HTTPS para realizar ataques Cross-Site Request Forgery (CSRF). • https://github.com/symfony/symfony/pull/24992 https://symfony.com/blog/cve-2017-16653-csrf-protection-does-not-use-different-tokens-for-http-and-https https://www.debian.org/security/2018/dsa-4262 •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-16790
https://notcve.org/view.php?id=CVE-2017-16790
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one array. This big array forms the data that are then bound to the form. At this stage there is no difference anymore between submitted POST data and uploaded files. A user can send a crafted HTTP request where the value of a "FileType" is sent as normal POST data that could be interpreted as a local file path on the server-side (for example, "file:///etc/passwd"). • https://symfony.com/blog/cve-2017-16790-ensure-that-submitted-data-are-uploaded-files https://www.debian.org/security/2018/dsa-4262 • CWE-20: Improper Input Validation •