| Package | Affected versions | Patched versions |
|---|---|---|
| symfony/security | ≥ 2.7.38, < 2.7.50≥ 2.8.0, < 2.8.49≥ 3.0.0, < 3.4.19≥ 4.0.0, < 4.0.15≥ 4.1.0, < 4.1.9≥ 4.2.0, < 4.2.1 | 2.7.502.8.493.4.194.0.154.1.94.2.1 |
| symfony/security-http | ≥ 2.7.38, < 2.7.50≥ 2.8.0, < 2.8.49≥ 3.0.0, < 3.4.20≥ 4.0.0, < 4.0.15≥ 4.1.0, < 4.1.9≥ 4.2.0, < 4.2.1 | 2.7.502.8.493.4.204.0.154.1.94.2.1 |
| symfony/symfony | ≥ 2.7.38, < 2.7.50≥ 2.8.0, < 2.8.49≥ 3.0.0, < 3.4.20≥ 4.0.0, < 4.0.15≥ 4.1.0, < 4.1.9 | 2.7.502.8.493.4.204.0.154.1.9 |
| symfony | ≥ 2.7.0, < 2.7.50≥ 2.8.0, < 2.8.49≥ 3.0.0, < 3.4.20≥ 4.0.0, < 4.0.15≥ 4.1.0, < 4.1.9≥ 4.2.0, < 4.2.1 | 2.7.502.8.493.4.204.0.154.1.94.2.1 |
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the _failure_path input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free