An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| symfony/security-http(Packagist) | 2.7.38 | 2.7.50 | N/A |
| symfony/security-http(Packagist) | 2.8.0 | 2.8.49 | N/A |
| symfony/security-http(Packagist) | 3.0.0 | 3.4.20 | N/A |
| symfony/security-http(Packagist) | 4.0.0 | 4.0.15 | N/A |
| symfony/security-http(Packagist) | 4.1.0 | 4.1.9 | N/A |
| symfony/security-http(Packagist) | 4.2.0 | 4.2.1 | N/A |
| symfony/security(Packagist) | 2.7.38 | 2.7.50 | N/A |
| symfony/security(Packagist) | 2.8.0 | 2.8.49 | N/A |
| symfony/security(Packagist) | 3.0.0 | 3.4.19 | N/A |
| symfony/security(Packagist) | 4.0.0 | 4.0.15 | N/A |
| symfony/security(Packagist) | 4.1.0 | 4.1.9 | N/A |
| symfony/security(Packagist) | 4.2.0 | 4.2.1 | N/A |
| symfony/symfony(Packagist) | 2.7.38 | 2.7.50 | N/A |
| symfony/symfony(Packagist) | 2.8.0 | 2.8.49 | N/A |
| symfony/symfony(Packagist) | 3.0.0 | 3.4.20 | N/A |
| symfony/symfony(Packagist) | 4.0.0 | 4.0.15 | N/A |
| symfony/symfony(Packagist) | 4.1.0 | 4.1.9 | N/A |
CVSS Metrics
