Open Redirect Affecting symfony/symfony package, versions >=2.7.0, <2.7.38 >=2.8.0, <2.8.31 >=3, <3.1.0 >=3.1.0, <3.2.0 >=3.2.0, <3.2.14 >=3.3.0, <3.3.13 >=3.4-BETA0, <3.4-BETA5 >=4.0-BETA0, <4.0-BETA5
Threat Intelligence
EPSS
0.07% (33rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SYMFONYSYMFONY-70381
- published 4 Dec 2017
- disclosed 17 Nov 2017
- credit Stefano Angaran
Introduced: 17 Nov 2017
CVE-2017-16652 Open this link in a new tabHow to fix?
Upgrade symfony/symfony to versions 2.7.38, 2.8.31, 3.1.0, 3.2.0, 3.2.14, 3.3.13 higher.
Overview
Affected versions of symfony/symfony are vulnerable to Open Redirect.
DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler take the content of the _target_path parameter and generate a redirect response but no check is performed on the path, which could be an absolute URL to an external domain, opening redirect vulnerability.
References
CVSS Scores
version 3.1