CVE-2019-10909
At a glance
- Source
- NVD
- EPSS
- EPSS 1.03 % · percentile 64 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-g996-q5r8-w7g2 — Symfony Cross-site Scripting (XSS) vulnerability
European references
- ENISA EUVD · EUVD-2019-0749
- GCVE · GCVE-0-2019-10909
CERT-FR advisories
- CERTFR-2019-AVI-180 — Multiples vulnérabilités dans Drupal · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 2.7.0 < 2.7.51cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 2.8.0 < 2.8.50cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.26cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.12cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.7cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.5.0 < 8.5.15cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.6.0 < 8.6.15
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |