PT-2018-6840 · Laravel+1 · Laravel Debugbar+1

C960657

·

Published

2018-07-20

·

Updated

2024-08-05

·

CVE-2017-18343

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: Symfony versions 2.7.x through 2.7.32 Symfony versions 2.8.x through 2.8.25 Symfony versions 3.x through 3.2.12 Symfony versions 3.3.x through 3.3.5
Description: The issue concerns a problem with the debug handler in Symfony, where there is a potential for XSS via an array key during exception pretty printing in ExceptionHandler.php. This can be demonstrated by a "/ debugbar/open?op=get" URI. The vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. The Symfony Debug component is also used by Laravel Debugbar.
Recommendations: For Symfony versions 2.7.x through 2.7.32, update to version 2.7.33 or later. For Symfony versions 2.8.x through 2.8.25, update to version 2.8.26 or later. For Symfony versions 3.x through 3.2.12, update to version 3.2.13 or later. For Symfony versions 3.3.x through 3.3.5, update to version 3.3.6 or later. As a temporary workaround, consider disabling the debug tools in production environments to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-18343

Affected Products

Laravel Debugbar
Symfony