GHSA-g996-q5r8-w7g2
Symfony Cross-site Scripting (XSS) vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2019-10909
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Description
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
Affected packages
| Package | Versions |
|---|---|
| Packagist · symfony/symfony | introduced 2.7.0, fixed 2.7.51 |
| Packagist · symfony/symfony | introduced 2.8.0, fixed 2.8.50 |
| Packagist · symfony/symfony | introduced 3.0.0, fixed 3.4.26 |
| Packagist · symfony/symfony | introduced 4.0.0, fixed 4.1.12 |
| Packagist · symfony/symfony | introduced 4.2.0, fixed 4.2.7 |
| Packagist · symfony/framework-bundle | introduced 2.7.0, fixed 2.7.51 |
| Packagist · symfony/framework-bundle | introduced 2.8.0, fixed 2.8.50 |
| Packagist · symfony/framework-bundle | introduced 3.0.0, fixed 3.4.26 |
| Packagist · symfony/framework-bundle | introduced 4.0.0, fixed 4.1.12 |
| Packagist · symfony/framework-bundle | introduced 4.2.0, fixed 4.2.7 |
| Packagist · drupal/core | introduced 8.0.0, fixed 8.5.15 |
| Packagist · drupal/core | introduced 8.6.0, fixed 8.6.15 |
| Packagist · drupal/drupal | introduced 8.0.0, fixed 8.5.15 |
| Packagist · drupal/drupal | introduced 8.6.0, fixed 8.6.15 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10909 ADVISORY
- https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2 WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml WEB
- https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine WEB
- https://symfony.com/cve-2019-10909 WEB
- https://www.drupal.org/sa-core-2019-005 WEB
- https://www.synology.com/security/advisory/Synology_SA_19_19 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |