Vulnerabilities > CVE-2017-16653

CVSS 5.9 - MEDIUM

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

high complexity

sensiolabs

debian

nessus

NVD

Published: 2018-08-06

Updated: 2019-10-03

Summary

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.

Vulnerable Configurations

Part	Description	Count
Application	Sensiolabs Sensiolabs Symfony 2.7.0 Sensiolabs Symfony 2.7.1 Sensiolabs Symfony 2.7.2 Sensiolabs Symfony 2.7.3 Sensiolabs Symfony 2.7.4 Sensiolabs Symfony 2.7.5 Sensiolabs Symfony 2.7.6 Sensiolabs Symfony 2.7.7 Sensiolabs Symfony 2.7.8 Sensiolabs Symfony 2.7.9 Sensiolabs Symfony 2.7.10 Sensiolabs Symfony 2.7.11 Sensiolabs Symfony 2.7.12 Sensiolabs Symfony 2.7.13 Sensiolabs Symfony 2.7.14 Sensiolabs Symfony 2.7.15 Sensiolabs Symfony 2.7.16 Sensiolabs Symfony 2.7.17 Sensiolabs Symfony 2.7.18 Sensiolabs Symfony 2.7.19 Sensiolabs Symfony 2.7.20 Sensiolabs Symfony 2.7.21 Sensiolabs Symfony 2.7.22 Sensiolabs Symfony 2.7.23 Sensiolabs Symfony 2.7.24 Sensiolabs Symfony 2.7.25 Sensiolabs Symfony 2.7.26 Sensiolabs Symfony 2.7.27 Sensiolabs Symfony 2.7.28 Sensiolabs Symfony 2.7.29 Sensiolabs Symfony 2.7.30 Sensiolabs Symfony 2.7.31 Sensiolabs Symfony 2.7.32 Sensiolabs Symfony 2.7.33 Sensiolabs Symfony 2.7.34 Sensiolabs Symfony 2.7.35 Sensiolabs Symfony 2.7.36 Sensiolabs Symfony 2.7.37 Sensiolabs Symfony 3.2.0 Sensiolabs Symfony 3.2.1 Sensiolabs Symfony 3.2.2 Sensiolabs Symfony 3.2.3 Sensiolabs Symfony 3.2.4 Sensiolabs Symfony 3.2.5 Sensiolabs Symfony 3.2.6 Sensiolabs Symfony 3.2.7 Sensiolabs Symfony 3.2.8 Sensiolabs Symfony 3.2.9 Sensiolabs Symfony 3.2.10 Sensiolabs Symfony 3.2.11 Sensiolabs Symfony 3.2.12 Sensiolabs Symfony 3.2.13 Sensiolabs Symfony 3.3.0 Sensiolabs Symfony 3.3.1 Sensiolabs Symfony 3.3.2 Sensiolabs Symfony 3.3.3 Sensiolabs Symfony 3.3.4 Sensiolabs Symfony 3.3.5 Sensiolabs Symfony 3.3.6 Sensiolabs Symfony 3.3.7 Sensiolabs Symfony 3.3.8 Sensiolabs Symfony 3.3.9 Sensiolabs Symfony 3.3.10 Sensiolabs Symfony 3.3.11 Sensiolabs Symfony 3.3.12 Sensiolabs Symfony *	73
OS	Debian Debian Debian Linux 9.0	1

Nessus

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-4262.NASL
description	Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to open redirects, cross-site request forgery, information disclosure, session fixation or denial of service.
last seen	2020-06-01
modified	2020-06-02
plugin id	111535
published	2018-08-06
reporter	This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111535
title	Debian DSA-4262-1 : symfony - security update

Vulnerabilities > CVE-2017-16653 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2017-16653"}]}

Summary

Vulnerable Configurations

Nessus

References

Vulnerabilities > CVE-2017-16653