NetSight
IP …
medium6.1

CVE-2018-19790

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x befor…

Impact

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.

Affected products

VendorProductAffected versions
SensiolabsSymfony
from 2.7.0 before 2.7.50
from 2.8.0 before 2.8.49
from 3.0.0 before 3.4.20
from 4.0.0 before 4.0.15
from 4.1.0 before 4.1.9
from 4.2.0 before 4.2.1
FedoraprojectFedora
Version 28
DebianDebian Linux
Version 8.0

Weakness classification

CWE-601

References