PT-2019-4599 · Symfony · Symfony

Michael Cullum · Published 2019-04-17 · Updated 2021-04-20 · CVE-2019-10909

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 2.7.51 Symfony versions 2.8.x prior to 2.8.50 Symfony versions 3.x prior to 3.4.26 Symfony versions 4.x prior to 4.1.12 Symfony versions 4.2.x prior to 4.2.7

Description The issue is related to the lack of protection measures for web page structures in the symfony/framework-bundle of the Symfony platform, which can lead to XSS attacks when user input is included in validation messages. This can allow a remote attacker to perform an XSS attack.

Recommendations For Symfony versions prior to 2.7.51, update to version 2.7.51 or later. For Symfony versions 2.8.x prior to 2.8.50, update to version 2.8.50 or later. For Symfony versions 3.x prior to 3.4.26, update to version 3.4.26 or later. For Symfony versions 4.x prior to 4.1.12, update to version 4.1.12 or later. For Symfony versions 4.2.x prior to 4.2.7, update to version 4.2.7 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-00699

CVE-2019-10909

DLA-1778-1

DSA-4441-1

GHSA-G996-Q5R8-W7G2

Affected Products

Symfony

References · 23

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml · Exploit
• https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2 · Patch
• https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10909 · Security Note
• https://bdu.fstec.ru/vul/2020-00699 · Security Note
• https://osv.dev/vulnerability/GHSA-g996-q5r8-w7g2 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4441-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10909 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10909 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10909 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10909 · Vendor Advisory