CVE-2017-16652 Symfony Open Redirect
MediumCVSS 6.1
EPSS 0.77%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates a redirect response, but no check is performed on the path, which could be an absolute URL to an external domain. This Open redirect vulnerability can be exploited for example to mount effective phishing attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony/symfony(Packagist) | >= 2.7.0, < 2.7.38 | 2.7.38 |
| symfony/symfony(Packagist) | = v2.7.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.10 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.11 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.12 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.13 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.14 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.15 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.16 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.17 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.18 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.19 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.2 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.20 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.21 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.22 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.23 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.24 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.25 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.26 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.27 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.28 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.29 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.3 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony/symfony(Packagist) | = v2.7.30 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.31 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.32 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.33 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.34 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.35 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.36 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.37 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.4 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.5 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.6 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.7 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.8 | No fix listed |
| symfony/symfony(Packagist) | = v2.7.9 | No fix listed |
| symfony/symfony(Packagist) | >= 2.8.0, < 2.8.31 | 2.8.31 |
| symfony/symfony(Packagist) | = v2.8.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.10 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.11 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.12 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.13 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.14 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.15 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.16 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.17 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.18 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.19 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.2 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.20 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.21 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.22 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.23 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.24 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.25 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.26 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.27 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.28 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.29 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.3 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.30 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.4 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.5 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.6 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.7 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.8 | No fix listed |
| symfony/symfony(Packagist) | = v2.8.9 | No fix listed |
| symfony/symfony(Packagist) | >= 3.2.0, < 3.2.14 | 3.2.14 |
| symfony/symfony(Packagist) | = v3.2.0 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.1 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.10 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.11 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.12 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.13 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.2 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.3 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.4 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.5 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.6 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.7 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.8 | No fix listed |
| symfony/symfony(Packagist) | = v3.2.9 | No fix listed |
| symfony/symfony(Packagist) | >= 3.3.0, < 3.3.13 | 3.3.13 |
| symfony/symfony(Packagist) | = v3.3.0 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.1 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.10 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.11 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.12 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.2 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.3 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.4 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.5 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.6 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.7 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.8 | No fix listed |
| symfony/symfony(Packagist) | = v3.3.9 | No fix listed |
| symfony/security-http(Packagist) | >= 2.7.0, < 2.7.38 | 2.7.38 |
| symfony/security-http(Packagist) | = v2.7.0 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.1 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.10 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.11 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.12 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.13 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.14 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.15 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.16 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.17 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.18 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.19 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.2 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.20 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.21 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.22 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.23 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.24 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.25 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.26 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.27 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.28 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.29 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.3 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.30 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.31 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.32 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.33 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.34 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.35 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.36 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.37 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.4 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.5 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.6 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.7 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.8 | No fix listed |
| symfony/security-http(Packagist) | = v2.7.9 | No fix listed |
| symfony/security-http(Packagist) | >= 2.8.0, < 2.8.31 | 2.8.31 |
| symfony/security-http(Packagist) | = v2.8.0 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.1 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.10 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.11 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.12 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.13 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.14 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.15 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.16 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.17 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.18 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.19 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.2 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.20 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.21 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.22 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.23 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.24 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.25 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.26 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.27 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.28 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.29 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.3 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.30 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.4 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.5 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.6 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.7 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.8 | No fix listed |
| symfony/security-http(Packagist) | = v2.8.9 | No fix listed |
| symfony/security-http(Packagist) | >= 3.2.0, < 3.2.14 | 3.2.14 |
| symfony/security-http(Packagist) | = v3.2.0 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.1 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.10 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.11 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.12 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.13 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.2 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.3 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.4 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.5 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.6 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.7 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.8 | No fix listed |
| symfony/security-http(Packagist) | = v3.2.9 | No fix listed |
| symfony/security-http(Packagist) | >= 3.3.0, < 3.3.13 | 3.3.13 |
| symfony/security-http(Packagist) | = v3.3.0 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.1 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.10 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.11 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.12 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.2 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.3 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.4 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.5 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.6 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.7 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.8 | No fix listed |
| symfony/security-http(Packagist) | = v3.3.9 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com exploit
- github.com exploit
- github.com product
- [debian-lts-announce] 20190310 [SECURITY] [DLA 1707-1] symfony security update mailing-list third-party-advisory
- symfony.com vendor-advisory
- symfony.com
- Debian Security Tracker CVE-2017-16652 vendor-advisory
- github.com