CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2018-14774
https://notcve.org/view.php?id=CVE-2018-14774
An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection. Se ha descubierto un problema en HttpKernel en Symfony, desde la versión 2.7.0 hasta la 2.7.48, desde la versión 2.8.0 hasta la 2.8.43, desde la versión 3.3.0 hasta la 3.3.17, desde la versión 3.4.0 hasta la 3.4.13, desde la versión 4.0.0 hasta la 4.0.13 y desde la versión 4.1.0 hasta la 4.1.2. Al emplear HttpCache, los valores de las cabeceras X-Forwarded-Host se asignan implícitamente como fiables, aunque debería estar prohibido, lo que conduce a una potencial inyección de cabeceras host. • https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 87%CPEs: 9EXPL: 0CVE-2018-14773
https://notcve.org/view.php?id=CVE-2018-14773
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning. • http://www.securityfocus.com/bid/104943 http://www.securitytracker.com/id/1041405 https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html https://seclists.org/bugtraq/2019/May/21 https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers https://www.debian.org/security/2019/dsa-4441 https://www.drupal.org/SA-CORE-2018-005 •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2018-11406
https://notcve.org/view.php?id=CVE-2018-11406
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation. Se ha descubierto un problema en el componente Security en Symfony en versiones 2.7.x anteriores a la 2.7.48, versiones 2.8.x anteriores a la 2.8.41, versiones 3.3.x anteriores a la 3.3.17, versiones 3.4.x anteriores a la 3.4.11 y versiones 4.0.x anteriores a la 4.0.11. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH https://symfony.com/blog/cve-2018-11406-csrf-token-fixation https://www.debian.org/security/2018/dsa-4262 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-11407
https://notcve.org/view.php?id=CVE-2018-11407
An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403. Se ha descubierto un problema en el componente Ldap en Symfony en versiones 2.8.x anteriores a la 2.8.37, versiones 3.3.x anteriores a la 3.3.17, versiones 3.4.x anteriores a la 3.4.7, y versiones 4.0.x anteriores a la 4.0.7. Permite que atacantes remotos omitan la autenticación mediante el inicio de sesión con una contraseña "null" y un nombre de usuario válido, lo que desencadena un enlace no autenticado. • https://symfony.com/blog/cve-2018-11407-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2018-11408
https://notcve.org/view.php?id=CVE-2018-11408
The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652. Los gestores de seguridad en el componente Security en Symfony en versiones 2.7.x anteriores a la 2.7.48, versiones 2.8.x anteriores a la 2.8.41, versiones 3.3.x anteriores a la 3.3.17, versiones 3.4.x anteriores a la 3.4.11 y versiones 4.0.x anteriores a la 4.0.11 tienen una vulnerabilidad de redirección abierta cuando security.http_utils ha sido insertado por un contenedor. NOTA: este problema existe debido a una solución incompleta para CVE-2017-16652. • https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •