Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2019-10909

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

VectorNETWORK

PublishedMay 16, 2019, 22:29

Published Bycve@mitre.org

Base Score

Score5.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

symfony/symfony(Packagist)2.7.02.7.51N/A

symfony/symfony(Packagist)2.8.02.8.50N/A

symfony/symfony(Packagist)3.0.03.4.26N/A

symfony/symfony(Packagist)4.0.04.1.12N/A

symfony/symfony(Packagist)4.2.04.2.7N/A

symfony/framework-bundle(Packagist)2.7.02.7.51N/A

symfony/framework-bundle(Packagist)2.8.02.8.50N/A

symfony/framework-bundle(Packagist)3.0.03.4.26N/A

symfony/framework-bundle(Packagist)4.0.04.1.12N/A

symfony/framework-bundle(Packagist)4.2.04.2.7N/A

drupal/core(Packagist)8.0.08.5.15N/A

drupal/core(Packagist)8.6.08.6.15N/A

drupal/drupal(Packagist)8.0.08.5.15N/A

drupal/drupal(Packagist)8.6.08.6.15N/A

References

Weakness Type

CWE-79

CVSS Metrics

Base Score

5.4

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK