CVE-2019-10909

{"id": "CVE-2019-10909", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2019-05-16T22:29:00.283", "references": [{"url": "https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.drupal.org/sa-core-2019-005", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.synology.com/security/advisory/Synology_SA_19_19", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.drupal.org/sa-core-2019-005", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.synology.com/security/advisory/Synology_SA_19_19", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle."}, {"lang": "es", "value": "En Symfony anterior de la versi\u00f3n 2.7.51, versi\u00f3n 2.8.x anterior de 2.8.50, versi\u00f3n 3.x anterior de 3.4.26, versi\u00f3n 4.x anterior de 4.1.12 y versi\u00f3n 4.2.x anterior de 4.2.7, los mensajes de validaci\u00f3n no son evadidos, lo que puede llevar a una vulnerabilidad de XSS cuando una entrada del usuario sea incluida. Esto est\u00e1 relacionado con symfony/framework-bundle"}], "lastModified": "2024-11-21T04:20:06.800", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A86884C0-A185-4CCF-AB21-1D1529AEDAED", "versionEndExcluding": "2.7.51", "versionStartIncluding": "2.7.0"}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4716654-1055-44B3-8E51-5BC0E739E0CB", "versionEndExcluding": "2.8.50", "versionStartIncluding": "2.8.0"}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF53486E-FAAC-40B3-82CE-4EDCD2C96690", "versionEndExcluding": "3.4.26", "versionStartIncluding": "3.4.0"}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25A92454-6E0B-4BDE-8967-BB3E32125102", "versionEndExcluding": "4.1.12", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53E58B92-6D5D-4949-B75F-687F52961FDA", "versionEndExcluding": "4.2.7", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9106BF81-B898-4EB0-B63C-9919D3B22260", "versionEndExcluding": "8.5.15", "versionStartIncluding": "8.5.0"}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B37281E-9B44-42A5-AE0A-17CE6770995C", "versionEndExcluding": "8.6.15", "versionStartIncluding": "8.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}