~ / search / GHSA-g996-q5r8-w7g2

GHSA-g996-q5r8-w7g2

Symfony Cross-site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10909

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/symfony >= 2.7.0, < 2.7.51 2.7.51
Packagist symfony/symfony >= 2.8.0, < 2.8.50 2.8.50
Packagist symfony/symfony >= 3.0.0, < 3.4.26 3.4.26
Packagist symfony/symfony >= 4.0.0, < 4.1.12 4.1.12
Packagist symfony/symfony >= 4.2.0, < 4.2.7 4.2.7
Packagist symfony/framework-bundle >= 2.7.0, < 2.7.51 2.7.51
Packagist symfony/framework-bundle >= 2.8.0, < 2.8.50 2.8.50
Packagist symfony/framework-bundle >= 3.0.0, < 3.4.26 3.4.26
Packagist symfony/framework-bundle >= 4.0.0, < 4.1.12 4.1.12
Packagist symfony/framework-bundle >= 4.2.0, < 4.2.7 4.2.7
Packagist drupal/core >= 8.0.0, < 8.5.15 8.5.15
Packagist drupal/core >= 8.6.0, < 8.6.15 8.6.15
Packagist drupal/drupal >= 8.0.0, < 8.5.15 8.5.15
Packagist drupal/drupal >= 8.6.0, < 8.6.15 8.6.15

Details

As written in the advisory (Markdown source, shown as plain text).

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

References

External links from the advisory. They lead to third-party sites.