PT-2019-15713 · Symfony · Symfony

Nicolas-Grekas · Publicado 2019-11-18 · Atualizado 2021-07-21 · CVE-2019-18886

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions 4.2.0 through 4.2.11 Symfony versions 4.3.0 through 4.3.7

Description An issue was discovered that allows the enumeration of users due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This issue is related to symfony/security.

Recommendations For Symfony versions 4.2.0 through 4.2.11, update to a version outside of this range to resolve the issue. For Symfony versions 4.3.0 through 4.3.7, update to a version outside of this range to resolve the issue.

Exploit

Correção

Information Disclosure

Side Channel Attack

Enumeração de Fraquezas

CWE-200

CWE-203

Identificadores relacionados

CVE-2019-18886

DLA-1999-1

GHSA-4VPC-5JX4-CFQG

Produtos afetados

Symfony

Referências · 16

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-18886.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18886.yaml · Exploit
• https://github.com/symfony/symfony/releases/tag/v4.3.8 · Nota
• https://github.com/symfony/symfony/commit/7bd4a92fc9cc15d9a9fbb9eb1041e01b977f8332 · Nota
• https://symfony.com/blog/symfony-4-3-8-released · Nota
• https://osv.dev/vulnerability/GHSA-4vpc-5jx4-cfqg · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-18886 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-18886 · Nota de Segurança
• https://osv.dev/vulnerability/DLA-1999-1 · Aviso do Fabricante
• https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-18886 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-18886 · Aviso do Fabricante
• https://symfony.com/cve-2019-18886 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18886 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-18886 · Aviso do Fabricante