CVE-2018-12040 — Cross-site Scripting in Symfony
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 47.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 13
Latest updateMay 14
Description
Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI. NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don't handle those issues as security issues).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages2 packages
🔴Vulnerability Details
4GHSA▶
GHSA-mjcw-3g32-5p52: ** DISPUTED ** Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3↗2022-05-14
OSV▶
CVE-2018-12040: ** DISPUTED ** Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3↗2018-06-13
CVEList▶
CVE-2018-12040: Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3↗2018-06-13
OSV▶
CVE-2018-12040: Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3↗2018-06-13
📋Vendor Advisories
1Debian▶
CVE-2018-12040: symfony - Reflected Cross-site scripting (XSS) vulnerability in the web profiler in Sensio...↗2018