CVE-2018-19790 -- symfonyID: oval:org.secpod.oval:def:2001517 | Date: (C)2019-04-21 (M)2023-11-13 |
Class: VULNERABILITY | Family: unix |
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.
Platform: |
Debian 8.x |
Debian 9.x |
Product: |
php-symfony-browser-kit |