VulnerableCode Package Details - pkg:composer/symfony/security@2.7.18

Search for packages

Advisory	Summary	Fixed in package version
CVE-2017-16652	URL Redirection to Untrusted Site (Open Redirect) `DefaultAuthenticationSuccessHandler` or `DefaultAuthenticationFailureHandler` takes the content of the `_target_path` parameter and generates a …	2.7.38 Vulnerable 2.8.31 Vulnerable 3.2.14 Vulnerable 3.3.13 Vulnerable
CVE-2016-4423	CVE-2016-4423: Large username storage in session The attemptAuthentication function in `Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php` does not limit the length of a username stored …	2.8.6 Vulnerable 3.0.6 Vulnerable 2.3.41 Vulnerable
CVE-2018-11406	Cross-Site Request Forgery (CSRF) By default, a user's session is invalidated when the user is logged out. This behavior can …	2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2018-11385	Session Fixation A session fixation vulnerability within the `Guard` login feature may allow an attacker to impersonate a victim towards …	2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2019-10911	Improper Authentication In Symfony, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user …	4.2.7 Vulnerable 2.8.50 Vulnerable 3.4.26 Vulnerable 2.7.51 Vulnerable
GHSA-g4rg-rw65-8hfg Aliases: CVE-2018-11385	Symfony Session Fixation Vulnerability An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, …	2.7.48 Vulnerable 2.7.48 Vulnerable
GHSA-r7p7-qr7p-2rrf Aliases: CVE-2017-16652	Symfony Open Redirect An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x …	2.7.38 Vulnerable 2.7.38 Vulnerable
GHSA-g4g7-q726-v5hg Aliases: CVE-2018-11406	Symfony CSRF Token Fixation An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, …	2.7.48 Vulnerable 2.7.48 Vulnerable
GHSA-92x6-h2gr-8gxq Aliases: CVE-2017-16653	Symfony CSRF Vulnerability An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation …	2.7.38 Vulnerable 2.7.38 Vulnerable
GHSA-cchx-mfrc-fwqr Aliases: CVE-2019-10911	Improper authentication in Symfony In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before …	2.7.51 Vulnerable 2.7.51 Vulnerable

Advisory

Summary

Fixed in package version

CVE-2017-16652

URL Redirection to Untrusted Site (Open Redirect) `DefaultAuthenticationSuccessHandler` or `DefaultAuthenticationFailureHandler` takes the content of the `_target_path` parameter and generates a …

2.7.38
Vulnerable

2.8.31
Vulnerable

3.2.14
Vulnerable

3.3.13
Vulnerable

CVE-2016-4423

CVE-2016-4423: Large username storage in session The attemptAuthentication function in `Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php` does not limit the length of a username stored …

2.8.6
Vulnerable

3.0.6
Vulnerable

2.3.41
Vulnerable

CVE-2018-11406

Cross-Site Request Forgery (CSRF) By default, a user's session is invalidated when the user is logged out. This behavior can …

2.8.41
Vulnerable

3.4.11
Vulnerable

4.0.11
Vulnerable

CVE-2018-11385

Session Fixation A session fixation vulnerability within the `Guard` login feature may allow an attacker to impersonate a victim towards …

2.8.41
Vulnerable

3.4.11
Vulnerable

4.0.11
Vulnerable

CVE-2019-10911

Improper Authentication In Symfony, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user …

4.2.7
Vulnerable

2.8.50
Vulnerable

3.4.26
Vulnerable

2.7.51
Vulnerable

GHSA-g4rg-rw65-8hfg
Aliases:
CVE-2018-11385

Symfony Session Fixation Vulnerability An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, …

2.7.48
Vulnerable

GHSA-r7p7-qr7p-2rrf
Aliases:
CVE-2017-16652

Symfony Open Redirect An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x …

2.7.38
Vulnerable

GHSA-g4g7-q726-v5hg
Aliases:
CVE-2018-11406

Symfony CSRF Token Fixation An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, …

2.7.48
Vulnerable

GHSA-92x6-h2gr-8gxq
Aliases:
CVE-2017-16653

Symfony CSRF Vulnerability An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation …

2.7.38
Vulnerable

GHSA-cchx-mfrc-fwqr
Aliases:
CVE-2019-10911

Improper authentication in Symfony In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before …

2.7.51
Vulnerable

Next non-vulnerable version	3.4.49
Latest non-vulnerable version	4.4.24
Risk score	4.0