CVE-2017-18343 — Cross-site Scripting in Symfony

CWE-79 — Cross-site Scripting6 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.5%
top 33.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SymfonySensiolabs Symfony
Timeline
PublishedJul 20
Latest updateMay 14

Description

The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDsensiolabs/symfony2.8.0 — 2.8.26+3
▶Debiansymfony/symfony< 3.4.0+dfsg-1+3
▶Ubuntusymfony/symfony< 3.4.6+dfsg-1ubuntu0.1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-mm4c-ww47-3x4c: ** DISPUTED ** The debug handler in Symfony before v2↗2022-05-14
▶
OSV
CVE-2017-18343: ** DISPUTED ** The debug handler in Symfony before v2↗2018-07-20
▶
OSV
CVE-2017-18343: The debug handler in Symfony before v2↗2018-07-20
▶
CVEList
CVE-2017-18343: The debug handler in Symfony before v2↗2018-07-20
▶

📋Vendor Advisories

1
Debian
CVE-2017-18343: symfony - The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3...↗2017
▶
CVE-2017-18343 — Cross-site Scripting in Symfony | cvebase