CVE-2018-19790
MEDIUM6.1EPSS 0.45%Symfony Open Redirect
Published: 5/14/2022Modified: 5/27/2026
Description
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.
Affected packages (4)
- Debian/symfonyfrom 0, < 3.4.20+dfsg-1
- Packagist/symfony/security>= 2.7.38, < 2.7.50
- Packagist/symfony/security-http>= 2.7.38, < 2.7.50
- Packagist/symfony/symfony>= 2.7.38, < 2.7.50
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
References (20)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-19790
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2018-19790
- PATCHhttps://github.com/symfony/symfony
- WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-19790.yaml
- WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-19790.yaml
- WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-19790.yaml
- WEBhttps://github.com/symfony/symfony/commit/99a0cec0a6be39ce5ef38386e57339603b33ee5b
- WEBhttps://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ
- WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7
- WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE
- WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ
- WEBhttps://seclists.org/bugtraq/2019/May/21
- WEBhttps://symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-when-using-security-http
- WEBhttps://symfony.com/cve-2018-19790
- WEBhttps://web.archive.org/web/20200227095826/http://www.securityfocus.com/bid/106249
- WEBhttps://www.debian.org/security/2019/dsa-4441
- WEBhttp://www.securityfocus.com/bid/106249