CVE-2019-10909
Published: 16 May 2019
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
drupal7 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Not vulnerable
|
|
| upstream |
Not vulnerable
(debian: Drupal 7 core not affected)
|
|
| xenial |
Not vulnerable
|
|
|
symfony Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| cosmic |
Ignored
(end of life)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Not vulnerable
(3.4.22+dfsg-2ubuntu1)
|
|
| focal |
Not vulnerable
(3.4.22+dfsg-2ubuntu1)
|
|
| groovy |
Not vulnerable
(3.4.22+dfsg-2ubuntu1)
|
|
| hirsute |
Not vulnerable
(3.4.22+dfsg-2ubuntu1)
|
|
| impish |
Not vulnerable
(3.4.22+dfsg-2ubuntu1)
|
|
| jammy |
Not vulnerable
(3.4.22+dfsg-2ubuntu1)
|
|
| kinetic |
Not vulnerable
(3.4.22+dfsg-2ubuntu1)
|
|
| lunar |
Not vulnerable
(3.4.22+dfsg-2ubuntu1)
|
|
| mantic |
Not vulnerable
(3.4.22+dfsg-2ubuntu1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(3.4.22+dfsg-2)
|
|
| xenial |
Needed
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.4 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |