CVE-2018-19790

2018-12-1822:29:05

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.4%

JSON

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the _failure_path input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.

CPENameOperatorVersion
security-httpeq2.7.49
security-httpeq2.8.49
security-httpeq4.2.0-RC1
security-httpeq3.4.20
security-httpeq4.2.0
security-httpeq2.7.50
security-httpeq4.2.0-BETA2
security-httpeq4.1.9
security-httpeq2.7.48

Name	Operator	Version
security-http	eq	2.7.49
security-http	eq	2.8.49
security-http	eq	4.2.0-RC1
security-http	eq	3.4.20
security-http	eq	4.2.0
security-http	eq	2.7.50
security-http	eq	4.2.0-BETA2
security-http	eq	4.1.9
security-http	eq	2.7.48