Symfony Open Redirect

🗓️ 14 May 2022 01:04:20Reported by GitHub Advisory DatabaseType

Symfony Open Redirect vulnerability in versions 2.7.x-2.7.50, 2.8.x-2.8.49, 3.x-3.4.20, 4.0.x-4.0.15, 4.1.x-4.1.9, and 4.2.x-4.2.1 allows attackers to redirect users to any domain post-login

Reporter	Title	Published	Views	Family All 45
CVE	CVE-2018-19790	18 Dec 201822:00	–	cve
Cvelist	CVE-2018-19790	18 Dec 201822:00	–	cvelist
Debian	[SECURITY] [DLA 1707-1] symfony security update	10 Mar 201901:19	–	debian
Debian	[SECURITY] [DSA 4441-1] symfony security update	10 May 201906:26	–	debian
Debian	[SECURITY] [DSA 4441-1] symfony security update	10 May 201906:26	–	debian
Debian CVE	CVE-2018-19790	18 Dec 201822:00	–	debiancve
Tenable Nessus	Debian DLA-1707-1 : symfony security update	11 Mar 201900:00	–	nessus
Tenable Nessus	Debian DSA-4441-1 : symfony - security update	13 May 201900:00	–	nessus
Tenable Nessus	Fedora 28 : php-symfony3 (2018-66547a8c14)	3 Jan 201900:00	–	nessus
Tenable Nessus	Fedora 28 : php-symfony4 (2018-6edf04d9d6)	3 Jan 201900:00	–	nessus

Vulners

Node

symfony symfonyRange4.1.0–4.1.9composer

symfony symfonyRange4.0.0–4.0.15composer

symfony symfonyRange3.0.0–3.4.20composer

symfony symfonyRange2.8.0–2.8.49composer

symfony symfonyRange2.7.38–2.7.50composer

symfony securityRange4.2.0–4.2.1composer

symfony securityRange4.1.0–4.1.9composer

symfony securityRange4.0.0–4.0.15composer

symfony securityRange3.0.0–3.4.19composer

symfony securityRange2.8.0–2.8.49composer

symfony securityRange2.7.38–2.7.50composer

symfony security-httpRange4.2.0–4.2.1composer

symfony security-httpRange4.1.0–4.1.9composer

symfony security-httpRange4.0.0–4.0.15composer

symfony security-httpRange3.0.0–3.4.20composer

symfony security-httpRange2.8.0–2.8.49composer

symfony security-httpRange2.7.38–2.7.50composer

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-19790
lists	www.lists.debian.org/debian-lts-announce/2019/03/msg00009.html
seclists	www.seclists.org/bugtraq/2019/May/21
symfony	www.symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-when-using-security-http
debian	www.debian.org/security/2019/dsa-4441
securityfocus	www.securityfocus.com/bid/106249
github	www.github.com/symfony/symfony/commit/99a0cec0a6be39ce5ef38386e57339603b33ee5b
web	www.web.archive.org/web/20200227095826/http://www.securityfocus.com/bid/106249
symfony	www.symfony.com/cve-2018-19790
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ

25 Apr 2024 22:12Current

6.5Medium risk

Vulners AI Score6.5

CVSS 25.8

CVSS 36.1

EPSS0.00447

CWE-601