CVE-2017-16652
First published: Thu Nov 16 2017(Updated: )
An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. `DefaultAuthenticationSuccessHandler` or `DefaultAuthenticationFailureHandler` takes the content of the `_target_path` parameter and generates a redirect response, but no check is performed on the path, which could be an absolute URL to an external domain. This Open redirect vulnerability can be exploited for example to mount effective phishing attacks.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/symfony/symfony | >=2.7.0<2.7.38>=2.8.0<2.8.31>=3.0.0<3.1.0>=3.1.0<3.2.0>=3.2.0<3.2.14>=3.3.0<3.3.13 | |
| composer/symfony/security | >=2.7.0<2.7.38>=2.8.0<2.8.31>=3.0.0<3.1.0>=3.1.0<3.2.0>=3.2.0<3.2.14>=3.3.0<3.3.13 | |
| composer/symfony/security-http | >=2.7.0<2.7.38>=2.8.0<2.8.31>=3.0.0<3.1.0>=3.1.0<3.2.0>=3.2.0<3.2.14>=3.3.0<3.3.13 | |
| SensioLabs Symfony | >2.7.0<2.7.38 | |
| SensioLabs Symfony | >2.8.0<2.8.31 | |
| SensioLabs Symfony | >3.2.0<3.2.14 | |
| SensioLabs Symfony | >=3.3.0<3.3.13 | |
| Debian Debian Linux | =8.0 | |
| composer/symfony/symfony | >=3.3.0<3.3.13 | 3.3.13 |
| composer/symfony/symfony | >=3.2.0<3.2.14 | 3.2.14 |
| composer/symfony/symfony | >=2.8.0<2.8.31 | 2.8.31 |
| composer/symfony/symfony | >=2.7.0<2.7.38 | 2.7.38 |
| composer/symfony/security | >=3.3.0<3.3.13 | 3.3.13 |
| composer/symfony/security | >=3.2.0<3.2.14 | 3.2.14 |
| composer/symfony/security | >=2.8.0<2.8.31 | 2.8.31 |
| composer/symfony/security | >=2.7.0<2.7.38 | 2.7.38 |
| composer/symfony/security-http | >=3.3.0<3.3.13 | 3.3.13 |
| composer/symfony/security-http | >=3.2.0<3.2.14 | 3.2.14 |
| composer/symfony/security-http | >=2.8.0<2.8.31 | 2.8.31 |
| composer/symfony/security-http | >=2.7.0<2.7.38 | 2.7.38 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://symfony.com/cve-2017-16652
- https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
- https://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers
- https://nvd.nist.gov/vuln/detail/CVE-2017-16652
- https://github.com/advisories/GHSA-r7p7-qr7p-2rrf (Advisory)
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2017-16652.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2017-16652.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16652.yaml
Frequently Asked Questions
What is CVE-2017-16652?
CVE-2017-16652 is an open redirect vulnerability found in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13.
What is the severity of CVE-2017-16652?
The severity of CVE-2017-16652 is medium with a CVSS score of 6.1.
How does CVE-2017-16652 affect Symfony?
CVE-2017-16652 affects Symfony versions 2.7.x to 2.7.38, 2.8.x to 2.8.31, 3.2.x to 3.2.14, and 3.3.x to 3.3.13.
How can I fix CVE-2017-16652?
To fix CVE-2017-16652, upgrade to Symfony version 2.7.38, 2.8.31, 3.2.14, or 3.3.13.
Where can I find more information about CVE-2017-16652?
You can find more information about CVE-2017-16652 in the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-16652), [Debian LTS](https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html), [Symfony Blog](https://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers).
- collector/friends-of-php
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r7p7-qr7p-2rrf
- alias/CVE-2017-16652
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/description
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- agent/trending
- package-manager/composer
- vendor/sensiolabs
- canonical/sensiolabs symfony
- version/sensiolabs symfony/3.3.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0