PT-2019-15713 · Symfony · Symfony

Nicolas-Grekas · Published 2019-11-18 · Updated 2021-07-21 · CVE-2019-18886

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions 4.2.0 through 4.2.11 Symfony versions 4.3.0 through 4.3.7

Description An issue was discovered that allows the enumeration of users due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This issue is related to symfony/security.

Recommendations For Symfony versions 4.2.0 through 4.2.11, update to a version outside of this range to resolve the issue. For Symfony versions 4.3.0 through 4.3.7, update to a version outside of this range to resolve the issue.

Exploit

Fix

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

CVE-2019-18886

DLA-1999-1

GHSA-4VPC-5JX4-CFQG

Affected Products

Symfony

References · 16

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-18886.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18886.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-4vpc-5jx4-cfqg · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-18886 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-18886 · Security Note
• https://osv.dev/vulnerability/DLA-1999-1 · Vendor Advisory
• https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-18886 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18886 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18886 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18886 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18886 · Vendor Advisory
• https://github.com/symfony/symfony/releases/tag/v4.3.8 · Note
• https://github.com/symfony/symfony/commit/7bd4a92fc9cc15d9a9fbb9eb1041e01b977f8332 · Note
• https://symfony.com/blog/symfony-4-3-8-released · Note