CVE Vulnerabilities

CVE-2017-16653

Published: Aug 06, 2018 | Modified: Oct 03, 2019
CVSS 3.x
5.9
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.

Affected Software

Name Vendor Start Version End Version
Symfony Sensiolabs 2.7.0 (including) 2.7.37 (including)
Symfony Sensiolabs 3.2.0 (including) 3.2.13 (including)
Symfony Sensiolabs 3.3.0 (including) 3.3.12 (including)
Symfony Sensiolabs 3.8.0 (including) 3.8.30 (including)
Symfony Ubuntu esm-apps/xenial *
Symfony Ubuntu upstream *
Symfony Ubuntu xenial *

References