CVE-2018-19790

Published: Dec 18, 2018Modified: Nov 21, 2024

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.

Affected (8)

Products: Sensiolabs: Symfony · Fedoraproject: Fedora · Debian: Debian Linux

1 product

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Sensiolabs Symfony	From 2.7.0 to 2.7.50
Sensiolabs Symfony	From 2.8.0 to 2.8.49
Sensiolabs Symfony	From 3.0.0 to 3.4.20
Sensiolabs Symfony	From 4.0.0 to 4.0.15
Sensiolabs Symfony	From 4.1.0 to 4.1.9
Sensiolabs Symfony	From 4.2.0 to 4.2.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 28

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (16)

http://www.securityfocus.com/bid/106249

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ/

Source: cve@mitre.org

https://seclists.org/bugtraq/2019/May/21

Source: cve@mitre.org

https://symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-when-using-security-http

Source: cve@mitre.org

PatchVendor Advisory

https://www.debian.org/security/2019/dsa-4441

Source: cve@mitre.org

http://www.securityfocus.com/bid/106249

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ/

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2019/May/21

Source: af854a3a-2127-422b-91ae-364da2661108

https://symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-when-using-security-http

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://www.debian.org/security/2019/dsa-4441

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.