CVEvulnerability
CVE-2019-10909
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-05-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
Affected configurations
• sensiolabs symfony (>= 2.7.0 < 2.7.51)
• sensiolabs symfony (>= 2.8.0 < 2.8.50)
• sensiolabs symfony (>= 3.4.0 < 3.4.26)
• sensiolabs symfony (>= 4.1.0 < 4.1.12)
• sensiolabs symfony (>= 4.2.0 < 4.2.7)
• drupal drupal (>= 8.5.0 < 8.5.15)
• drupal drupal (>= 8.6.0 < 8.6.15)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2 Patch, Third Party Advisory
- https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine Vendor Advisory
- https://www.drupal.org/sa-core-2019-005 Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_19_19 Third Party Advisory
- https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2 Patch, Third Party Advisory
- https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine Vendor Advisory
- https://www.drupal.org/sa-core-2019-005 Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_19_19 Third Party Advisory