Search for packages
| purl | pkg:composer/symfony/symfony@3.8.0 |
| Tags | Ghost |
| Next non-vulnerable version | 5.4.46 |
| Latest non-vulnerable version | 7.2.0-BETA1 |
| Risk | 3.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-wdzq-fpju-2uf5
Aliases: CVE-2017-16653 GHSA-92x6-h2gr-8gxq |
Symfony CSRF Vulnerability An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks. |
Affected by 25 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-07-01T18:11:06.280650+00:00 | GitLab Importer | Affected by | VCID-wdzq-fpju-2uf5 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/symfony/CVE-2017-16653.yml | 36.1.3 |