Moderate severity vulnerability that affects org.b3log:symphony

MEDIUM 6.1CVE-2019-9142 · GHSA-xgjc-49cw-529m · Published 25/02/2019 · updated 17/06/2026

In short

CVE-2019-9142 is a MEDIUM (CVSS 6.1) vulnerability affecting org.b3log:symphony, symphony (b3log).
Chance of exploitation in the next 30 days (EPSS): 0.80%, higher than 56.7% of all vulnerabilities.
Fix: update to 3.4.7 or later.

Package	Affected versions	Patched versions
org.b3log:symphony Maven	`< 3.4.7`	`3.4.7`
symphony b3log	`< 3.4.7`	`3.4.7`

Description

An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.

NVD description

An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.

References

nvd.nist.gov/vuln/detail/CVE-2019-9142 · ADVISORY
b3log/symphony · WEB
GitHub Advisory GHSA-xgjc-49cw-529m · ADVISORY
b3log/symphony · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free