CVE-2017-16652
Symfony Open Redirect
Also known as GHSA-r7p7-qr7p-2rrf
Published 8 y ago · modified 4 mo ago · JSON
Summary
An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates a redirect response, but no check is performed on the path, which could be an absolute URL to an external domain. This Open redirect vulnerability can be exploited for example to mount effective phishing attacks.
Exploit prediction (EPSS)
0.77% probability of exploitation in the next 30 days, higher than 56% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| GitHub | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | symfony/symfony | >=2.7.0, <2.7.38 >=2.8.0, <2.8.31 >=3.2.0, <3.2.14 >=3.3.0, <3.3.13 | 2.7.38 2.8.31 3.2.14 3.3.13 |
| packagist | symfony/security-http | >=2.7.0, <2.7.38 >=2.8.0, <2.8.31 >=3.2.0, <3.2.14 >=3.3.0, <3.3.13 | 2.7.38 2.8.31 3.2.14 3.3.13 |
| packagist | symfony/security | >=2.7.0, <2.7.38 >=2.8.0, <2.8.31 >=3.2.0, <3.2.14 >=3.3.0, <3.3.13 | 2.7.38 2.8.31 3.2.14 3.3.13 |
Classification
- Weakness
- CWE-601 URL Redirection to Untrusted Site
References
- symfony.com /blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers · x_refsource_CONFIRM, x_transferred
- lists.debian.org /debian-lts-announce/2019/03/msg00009.html · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-16652 · advisory
- github.com /FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2017-16652.yaml · web
- github.com /FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2017-16652.yaml · web
- github.com /FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16652.yaml · web
- github.com /symfony/symfony · package
- symfony.com /cve-2017-16652 · web
Sources
- CVE List: CVE-2017-16652
- GitHub Advisory: GHSA-r7p7-qr7p-2rrf
- NVD: CVE-2017-16652
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.