{"action":"Upgrade symfony/symfony to 2.7.38 or later.","affected":[{"fixed":"2.7.38","introduced":"2.7.0"},{"fixed":"2.8.31","introduced":"2.8.0"},{"fixed":"3.2.14","introduced":"3.0.0"},{"fixed":"3.3.13","introduced":"3.3.0"}],"component":"symfony/symfony","cve_ids":["CVE-2017-16653"],"ecosystem":"Packagist","epss":0.01486,"exploited":false,"fixed_versions":["2.7.38","2.8.31","3.2.14","3.3.13"],"ghsa_id":"GHSA-92x6-h2gr-8gxq","id":"tcs_01M5KEZHGDJ25GKHSZAWEQ0PA1","modified_at":"2024-02-16T08:15:55.037095Z","published_at":"2022-05-13T01:44:08Z","references":["https://osv.dev/vulnerability/GHSA-92x6-h2gr-8gxq","https://nvd.nist.gov/vuln/detail/CVE-2017-16653","https://github.com/symfony/symfony/pull/24992","https://github.com/symfony/symfony/commit/b4dbdd7cd8732483d585eacff3428c16b07ad15e","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-csrf/CVE-2017-16653.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2017-16653.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16653.yaml","https://github.com/symfony/symfony","https://symfony.com/blog/cve-2017-16653-csrf-protection-does-not-use-different-tokens-for-http-and-https","https://symfony.com/cve-2017-16653","https://www.debian.org/security/2018/dsa-4262"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-92x6-h2gr-8gxq#Packagist/symfony/symfony","url":"https://osv.dev/vulnerability/GHSA-92x6-h2gr-8gxq"}],"summary":"Symfony CSRF Vulnerability"}