Symfony Open Redirect

TRUNG BÌNH 6.1CVE-2017-16652 · GHSA-r7p7-qr7p-2rrf · Công bố 13/06/2018 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2017-16652 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng symfony/security, symfony/security-http, symfony/symfony.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.77%, cao hơn 55.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.7.38, 2.8.31, 3.2.14, 3.3.13 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
symfony/security Packagist	`≥ 2.7.0, < 2.7.38≥ 2.8.0, < 2.8.31≥ 3.2.0, < 3.2.14≥ 3.3.0, < 3.3.13`	`2.7.382.8.313.2.143.3.13`
symfony/security-http Packagist	`≥ 2.7.0, < 2.7.38≥ 2.8.0, < 2.8.31≥ 3.2.0, < 3.2.14≥ 3.3.0, < 3.3.13`	`2.7.382.8.313.2.143.3.13`
symfony/symfony Packagist	`≥ 2.7.0, < 2.7.38≥ 2.8.0, < 2.8.31≥ 3.2.0, < 3.2.14≥ 3.3.0, < 3.3.13`	`2.7.382.8.313.2.143.3.13`
symfony sensiolabs	`≥ 3.3.0, < 3.3.13> 2.7.0, < 2.7.38> 2.8.0, < 2.8.31> 3.2.0, < 3.2.14`	`3.3.132.7.382.8.313.2.14`

Mô tả

An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates a redirect response, but no check is performed on the path, which could be an absolute URL to an external domain. This Open redirect vulnerability can be exploited for example to mount effective phishing attacks.

Mô tả của NVD

An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates a redirect response, but no check is performed on the path, which could be an absolute URL to an external domain. This Open redirect vulnerability can be exploited for example to mount effective phishing attacks.