Open redirect in Symfony - CVE-2018-19790

Vulnerability identifier: #VU16615

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-19790

CWE-ID: CWE-601

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to redirect the target user to external websites.

The weakness exists due to improper sanitization of user-supplied data. A remote attacker can use backslashes in the `_failure_path` input field of login forms, work around the redirection target restrictions and effectively redirect the user to any domain after login.

Symfony
symfony (Debian package)
php-symfony
php-symfony3
php-symfony4
Fedora

The vulnerability has been fixed in the versions 2.7.50, 2.8.49, 3.4.20, 4.0.15, 4.1.9 and 4.2.1.

Symfony - addressed in versions 2.7.50, 2.8.49, 3.4.20, 4.0.15, 4.1.9, 4.2.1
symfony (Debian package) - update to 2.8.7+dfsg-1.3+deb9u2
php-symfony - addressed in versions 2.8.49-1.fc28, 2.8.49-1.fc29
php-symfony3 - addressed in versions 3.4.20-1.fc28, 3.4.20-1.fc29
php-symfony4 - addressed in versions 4.0.15-1.fc28, 4.1.9-1.fc29

• https://symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-when-using-security-http

• Multiple vulnerabilities in Symfony
• Debian update for symfony
• Fedora 28 update for php-symfony3
• Fedora 29 update for php-symfony3
• Fedora 28 update for php-symfony
• Fedora 29 update for php-symfony
• Fedora 29 update for php-symfony4
• Fedora 28 update for php-symfony4