{"action":"Upgrade symfony/symfony to 2.7.38 or later.","affected":[{"fixed":"2.7.38","introduced":"2.7.0"},{"fixed":"2.8.31","introduced":"2.8.0"},{"fixed":"3.2.14","introduced":"3.0.0"},{"fixed":"3.3.13","introduced":"3.3.0"}],"component":"symfony/symfony","cve_ids":["CVE-2017-16790"],"ecosystem":"Packagist","epss":0.01568,"exploited":false,"fixed_versions":["2.7.38","2.8.31","3.2.14","3.3.13"],"ghsa_id":"GHSA-cqqh-94r6-wjrg","id":"tcs_01M5KF152JDMTHK4321766438F","modified_at":"2024-04-25T22:28:47.780733Z","published_at":"2022-05-14T02:41:31Z","references":["https://osv.dev/vulnerability/GHSA-cqqh-94r6-wjrg","https://nvd.nist.gov/vuln/detail/CVE-2017-16790","https://github.com/symfony/symfony/pull/24993","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/form/CVE-2017-16790.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16790.yaml","https://github.com/symfony/form","https://symfony.com/blog/cve-2017-16790-ensure-that-submitted-data-are-uploaded-files","https://symfony.com/cve-2017-16790","https://www.debian.org/security/2018/dsa-4262"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cqqh-94r6-wjrg#Packagist/symfony/symfony","url":"https://osv.dev/vulnerability/GHSA-cqqh-94r6-wjrg"}],"summary":"Symfony SSRF Vulnerability via Form Component"}