Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/39962?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39962?format=api", "vulnerability_id": "VCID-djnm-e9r4-c3f5", "summary": "`DefaultAuthenticationSuccessHandler` or `DefaultAuthenticationFailureHandler` take the content of the `_target_path` parameter and generate a redirect response but no check is performed on the path, which could be an absolute URL to an external domain, opening redirect vulnerability. Open redirect vulnerability are not too much considered but they can be exploited for example to mount effective phishing attacks.", "aliases": [ { "alias": "CVE-2017-16652" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55893?format=api", "purl": "pkg:composer/symfony/security@2.7.38", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-mew1-9shg-mugs" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.7.38" }, { "url": "http://public2.vulnerablecode.io/api/packages/55894?format=api", "purl": "pkg:composer/symfony/security@2.8.31", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.8.31" }, { "url": "http://public2.vulnerablecode.io/api/packages/55895?format=api", "purl": "pkg:composer/symfony/security@3.2.14", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@3.2.14" }, { "url": "http://public2.vulnerablecode.io/api/packages/55896?format=api", "purl": "pkg:composer/symfony/security@3.3.13", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@3.3.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/55821?format=api", "purl": "pkg:composer/symfony/security-http@2.7.38", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-mew1-9shg-mugs" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@2.7.38" }, { "url": "http://public2.vulnerablecode.io/api/packages/55822?format=api", "purl": "pkg:composer/symfony/security-http@2.8.31", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@2.8.31" }, { "url": "http://public2.vulnerablecode.io/api/packages/55823?format=api", "purl": "pkg:composer/symfony/security-http@3.2.14", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@3.2.14" }, { "url": "http://public2.vulnerablecode.io/api/packages/55824?format=api", "purl": "pkg:composer/symfony/security-http@3.3.13", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@3.3.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/55825?format=api", "purl": "pkg:composer/symfony/security-http@3.4.0-BETA5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@3.4.0-BETA5" }, { "url": "http://public2.vulnerablecode.io/api/packages/55826?format=api", "purl": "pkg:composer/symfony/security-http@4.0.0-BETA5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@4.0.0-BETA5" }, { "url": "http://public2.vulnerablecode.io/api/packages/55847?format=api", "purl": "pkg:composer/symfony/symfony@2.7.38", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-frbz-vpfe-vbh9" }, { "vulnerability": "VCID-mew1-9shg-mugs" }, { "vulnerability": "VCID-tx26-92jc-rkff" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.38" }, { "url": "http://public2.vulnerablecode.io/api/packages/55848?format=api", "purl": "pkg:composer/symfony/symfony@2.8.31", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.31" }, { "url": "http://public2.vulnerablecode.io/api/packages/55849?format=api", "purl": "pkg:composer/symfony/symfony@3.2.14", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.2.14" }, { "url": "http://public2.vulnerablecode.io/api/packages/55850?format=api", "purl": "pkg:composer/symfony/symfony@3.3.13", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/55851?format=api", "purl": "pkg:composer/symfony/symfony@3.4.0-BETA5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.0-BETA5" }, { "url": "http://public2.vulnerablecode.io/api/packages/55852?format=api", "purl": "pkg:composer/symfony/symfony@4.0.0-BETA5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.0-BETA5" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52445?format=api", "purl": "pkg:composer/symfony/security@2.7.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-23hr-yznx-c3fb" }, { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-dsbx-q641-4fc7" }, { "vulnerability": "VCID-gjuz-mjah-e3bj" }, { "vulnerability": "VCID-ty9b-xe8v-r7ag" }, { "vulnerability": "VCID-uk5a-g7em-gygd" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.7.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/53263?format=api", "purl": "pkg:composer/symfony/security@2.8.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14k5-2gnt-8qgd" }, { "vulnerability": "VCID-23hr-yznx-c3fb" }, { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-dsbx-q641-4fc7" }, { "vulnerability": "VCID-mew1-9shg-mugs" }, { "vulnerability": "VCID-uuk9-e5qy-rfgf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@2.8.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/52723?format=api", "purl": "pkg:composer/symfony/security@3.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14k5-2gnt-8qgd" }, { "vulnerability": "VCID-23hr-yznx-c3fb" }, { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-dsbx-q641-4fc7" }, { "vulnerability": "VCID-ef86-hqv4-6kaz" }, { "vulnerability": "VCID-mew1-9shg-mugs" }, { "vulnerability": "VCID-uuk9-e5qy-rfgf" }, { "vulnerability": "VCID-vyug-krcw-jyef" }, { "vulnerability": "VCID-x4nv-gvag-7qf2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@3.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55892?format=api", "purl": "pkg:composer/symfony/security@3.3.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-dsbx-q641-4fc7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security@3.3.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55813?format=api", "purl": "pkg:composer/symfony/security-http@2.7.0-alpha0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@2.7.0-alpha0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55814?format=api", "purl": "pkg:composer/symfony/security-http@2.7.37", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@2.7.37" }, { "url": "http://public2.vulnerablecode.io/api/packages/55815?format=api", "purl": "pkg:composer/symfony/security-http@2.8.0-alpha0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@2.8.0-alpha0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55816?format=api", "purl": "pkg:composer/symfony/security-http@2.8.30", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@2.8.30" }, { "url": "http://public2.vulnerablecode.io/api/packages/55817?format=api", "purl": "pkg:composer/symfony/security-http@3.2.0-alpha0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@3.2.0-alpha0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55818?format=api", "purl": "pkg:composer/symfony/security-http@3.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@3.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/55819?format=api", "purl": "pkg:composer/symfony/security-http@3.3.0-alpha0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@3.3.0-alpha0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55820?format=api", "purl": "pkg:composer/symfony/security-http@3.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/security-http@3.3.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/55839?format=api", "purl": "pkg:composer/symfony/symfony@2.7.0-alpha0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-xdtu-22ad-63aq" }, { "vulnerability": "VCID-xj13-fspe-hfgv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.0-alpha0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55840?format=api", "purl": "pkg:composer/symfony/symfony@2.7.37", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-dsbx-q641-4fc7" }, { "vulnerability": "VCID-xdtu-22ad-63aq" }, { "vulnerability": "VCID-xj13-fspe-hfgv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.37" }, { "url": "http://public2.vulnerablecode.io/api/packages/55841?format=api", "purl": "pkg:composer/symfony/symfony@2.8.0-alpha0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-xdtu-22ad-63aq" }, { "vulnerability": "VCID-xj13-fspe-hfgv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.0-alpha0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55842?format=api", "purl": "pkg:composer/symfony/symfony@2.8.30", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-xdtu-22ad-63aq" }, { "vulnerability": "VCID-xj13-fspe-hfgv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.30" }, { "url": "http://public2.vulnerablecode.io/api/packages/55843?format=api", "purl": "pkg:composer/symfony/symfony@3.2.0-alpha0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-xdtu-22ad-63aq" }, { "vulnerability": "VCID-xj13-fspe-hfgv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.2.0-alpha0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55844?format=api", "purl": "pkg:composer/symfony/symfony@3.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-dsbx-q641-4fc7" }, { "vulnerability": "VCID-xdtu-22ad-63aq" }, { "vulnerability": "VCID-xj13-fspe-hfgv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/55845?format=api", "purl": "pkg:composer/symfony/symfony@3.3.0-alpha0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-xdtu-22ad-63aq" }, { "vulnerability": "VCID-xj13-fspe-hfgv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.0-alpha0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55846?format=api", "purl": "pkg:composer/symfony/symfony@3.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-djnm-e9r4-c3f5" }, { "vulnerability": "VCID-dsbx-q641-4fc7" }, { "vulnerability": "VCID-xdtu-22ad-63aq" }, { "vulnerability": "VCID-xj13-fspe-hfgv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.12" } ], "references": [ { "reference_url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16652", "reference_id": "", "reference_type": "", "scores": [], "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16652" }, { "reference_url": "https://github.com/symfony/symfony/pull/24995", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/symfony/symfony/pull/24995" }, { "reference_url": "https://symfony.com/cve-2017-16652", "reference_id": "CVE-2017-16652", "reference_type": "", "scores": [], "url": "https://symfony.com/cve-2017-16652" }, { "reference_url": "http://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers", "reference_id": "CVE-2017-16652-OPEN-REDIRECT-VULNERABILITY-ON-SECURITY-HANDLERS", "reference_type": "", "scores": [], "url": "http://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 601, "name": "URL Redirection to Untrusted Site ('Open Redirect')", "description": "A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": null, "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-djnm-e9r4-c3f5" }