Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2018-11408

The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.

VectorNETWORK

PublishedJun 13, 2018, 16:29

Published Bycve@mitre.org

Base Score

Score6.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

symfony/symfony(Packagist)2.7.02.7.48N/A

symfony/symfony(Packagist)2.8.02.8.41N/A

symfony/symfony(Packagist)3.3.03.3.17N/A

symfony/symfony(Packagist)3.4.03.4.11N/A

symfony/symfony(Packagist)4.0.04.0.11N/A

symfony/security-bundle(Packagist)2.7.02.7.48N/A

symfony/security-bundle(Packagist)2.8.02.8.41N/A

symfony/security-bundle(Packagist)3.3.03.3.17N/A

symfony/security-bundle(Packagist)3.4.03.4.11N/A

symfony/security-bundle(Packagist)4.0.04.0.11N/A

References

Weakness Type

CWE-601

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.0

Attack Vector (AV)

NETWORK