Packagist/symfony/symfony CVE-2019-10909: medium 5.4, EPSS 1.03%

Symfony Cross-site Scripting (XSS) vulnerability

Action: Upgrade symfony/symfony to 2.7.51 or later.

composer require symfony/symfony:2.7.51

composer require symfony/symfony:2.8.50

composer require symfony/symfony:3.4.26

composer require symfony/symfony:4.1.12

composer require symfony/symfony:4.2.7

Affected

Fixed versions

Sources

• osv: GHSA-g996-q5r8-w7g2
• https://nvd.nist.gov/vuln/detail/CVE-2019-10909
• https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2
• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml
• https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine
• https://symfony.com/cve-2019-10909
• https://www.drupal.org/sa-core-2019-005
• https://www.synology.com/security/advisory/Synology_SA_19_19

CVE-2019-10909 · published 2019-11-12T23:00:53Z · modified 2024-02-16T08:21:49.261419Z · JSON