Vulnerability advisory

GHSA-g996-q5r8-w7g2

Symfony Cross-site Scripting (XSS) vulnerability

Published Nov 12, 2019Updated Feb 16, 2024OSV record ↗

Also known as CVE-2019-10909

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

symfony/symfony Packagist

All symfony/symfony advisories →

Affected	Fixed in
`2.7.0` to before 2.7.51	`2.7.51`Advisories →
Also listed as affected (51) `v2.7.0` `v2.7.1` `v2.7.10` `v2.7.11` `v2.7.12` `v2.7.13` `v2.7.14` `v2.7.15` `v2.7.16` `v2.7.17` `v2.7.18` `v2.7.19` `v2.7.2` `v2.7.20` `v2.7.21` `v2.7.22` `v2.7.23` `v2.7.24` `v2.7.25` `v2.7.26` `v2.7.27` `v2.7.28` `v2.7.29` `v2.7.3` `v2.7.30` `v2.7.31` `v2.7.32` `v2.7.33` `v2.7.34` `v2.7.35` `v2.7.36` `v2.7.37` `v2.7.38` `v2.7.39` `v2.7.4` `v2.7.40` `v2.7.41` `v2.7.42` `v2.7.43` `v2.7.44` `v2.7.45` `v2.7.46` `v2.7.47` `v2.7.48` `v2.7.49` `v2.7.5` `v2.7.50` `v2.7.6` `v2.7.7` `v2.7.8` `v2.7.9`
`2.8.0` to before 2.8.50	`2.8.50`Advisories →
Also listed as affected (50) `v2.8.0` `v2.8.1` `v2.8.10` `v2.8.11` `v2.8.12` `v2.8.13` `v2.8.14` `v2.8.15` `v2.8.16` `v2.8.17` `v2.8.18` `v2.8.19` `v2.8.2` `v2.8.20` `v2.8.21` `v2.8.22` `v2.8.23` `v2.8.24` `v2.8.25` `v2.8.26` `v2.8.27` `v2.8.28` `v2.8.29` `v2.8.3` `v2.8.30` `v2.8.31` `v2.8.32` `v2.8.33` `v2.8.34` `v2.8.35` `v2.8.36` `v2.8.37` `v2.8.38` `v2.8.39` `v2.8.4` `v2.8.40` `v2.8.41` `v2.8.42` `v2.8.43` `v2.8.44` `v2.8.45` `v2.8.46` `v2.8.47` `v2.8.48` `v2.8.49` `v2.8.5` `v2.8.6` `v2.8.7` `v2.8.8` `v2.8.9`
`3.0.0` to before 3.4.26	`3.4.26`Advisories →
Also listed as affected (94) `v3.0.0` `v3.0.1` `v3.0.2` `v3.0.3` `v3.0.4` `v3.0.5` `v3.0.6` `v3.0.7` `v3.0.8` `v3.0.9` `v3.1.0` `v3.1.0-BETA1` `v3.1.0-RC1` `v3.1.1` `v3.1.10` `v3.1.2` `v3.1.3` `v3.1.4` `v3.1.5` `v3.1.6` `v3.1.7` `v3.1.8` `v3.1.9` `v3.2.0` `v3.2.0-BETA1` `v3.2.0-RC1` `v3.2.0-RC2` `v3.2.1` `v3.2.10` `v3.2.11` `v3.2.12` `v3.2.13` `v3.2.14` `v3.2.2` `v3.2.3` `v3.2.4` `v3.2.5` `v3.2.6` `v3.2.7` `v3.2.8` `v3.2.9` `v3.3.0` `v3.3.0-BETA1` `v3.3.0-RC1` `v3.3.1` `v3.3.10` `v3.3.11` `v3.3.12` `v3.3.13` `v3.3.14` `v3.3.15` `v3.3.16` `v3.3.17` `v3.3.18` `v3.3.2` `v3.3.3` `v3.3.4` `v3.3.5` `v3.3.6` `v3.3.7` `v3.3.8` `v3.3.9` `v3.4.0` `v3.4.0-BETA1` `v3.4.0-BETA2` `v3.4.0-BETA3` `v3.4.0-BETA4` `v3.4.0-RC1` `v3.4.0-RC2` `v3.4.1` `v3.4.10` `v3.4.11` `v3.4.12` `v3.4.13` `v3.4.14` `v3.4.15` `v3.4.16` `v3.4.17` `v3.4.18` `v3.4.19` `v3.4.2` `v3.4.20` `v3.4.21` `v3.4.22` `v3.4.23` `v3.4.24` `v3.4.25` `v3.4.3` `v3.4.4` `v3.4.5` `v3.4.6` `v3.4.7` `v3.4.8` `v3.4.9`
`4.0.0` to before 4.1.12	`4.1.12`Advisories →
Also listed as affected (31) `v4.0.0` `v4.0.1` `v4.0.10` `v4.0.11` `v4.0.12` `v4.0.13` `v4.0.14` `v4.0.15` `v4.0.2` `v4.0.3` `v4.0.4` `v4.0.5` `v4.0.6` `v4.0.7` `v4.0.8` `v4.0.9` `v4.1.0` `v4.1.0-BETA1` `v4.1.0-BETA2` `v4.1.0-BETA3` `v4.1.1` `v4.1.10` `v4.1.11` `v4.1.2` `v4.1.3` `v4.1.4` `v4.1.5` `v4.1.6` `v4.1.7` `v4.1.8` `v4.1.9`
`4.2.0` to before 4.2.7	`4.2.7`Advisories →
Also listed as affected (7) `v4.2.0` `v4.2.1` `v4.2.2` `v4.2.3` `v4.2.4` `v4.2.5` `v4.2.6`

symfony/framework-bundle Packagist

All symfony/framework-bundle advisories →

Affected	Fixed in
`2.7.0` to before 2.7.51	`2.7.51`Advisories →
Also listed as affected (51) `v2.7.0` `v2.7.1` `v2.7.10` `v2.7.11` `v2.7.12` `v2.7.13` `v2.7.14` `v2.7.15` `v2.7.16` `v2.7.17` `v2.7.18` `v2.7.19` `v2.7.2` `v2.7.20` `v2.7.21` `v2.7.22` `v2.7.23` `v2.7.24` `v2.7.25` `v2.7.26` `v2.7.27` `v2.7.28` `v2.7.29` `v2.7.3` `v2.7.30` `v2.7.31` `v2.7.32` `v2.7.33` `v2.7.34` `v2.7.35` `v2.7.36` `v2.7.37` `v2.7.38` `v2.7.39` `v2.7.4` `v2.7.40` `v2.7.41` `v2.7.42` `v2.7.43` `v2.7.44` `v2.7.45` `v2.7.46` `v2.7.47` `v2.7.48` `v2.7.49` `v2.7.5` `v2.7.50` `v2.7.6` `v2.7.7` `v2.7.8` `v2.7.9`
`2.8.0` to before 2.8.50	`2.8.50`Advisories →
Also listed as affected (50) `v2.8.0` `v2.8.1` `v2.8.10` `v2.8.11` `v2.8.12` `v2.8.13` `v2.8.14` `v2.8.15` `v2.8.16` `v2.8.17` `v2.8.18` `v2.8.19` `v2.8.2` `v2.8.20` `v2.8.21` `v2.8.22` `v2.8.23` `v2.8.24` `v2.8.25` `v2.8.26` `v2.8.27` `v2.8.28` `v2.8.29` `v2.8.3` `v2.8.30` `v2.8.31` `v2.8.32` `v2.8.33` `v2.8.34` `v2.8.35` `v2.8.36` `v2.8.37` `v2.8.38` `v2.8.39` `v2.8.4` `v2.8.40` `v2.8.41` `v2.8.42` `v2.8.43` `v2.8.44` `v2.8.45` `v2.8.46` `v2.8.47` `v2.8.48` `v2.8.49` `v2.8.5` `v2.8.6` `v2.8.7` `v2.8.8` `v2.8.9`
`3.0.0` to before 3.4.26	`3.4.26`Advisories →
Also listed as affected (94) `v3.0.0` `v3.0.1` `v3.0.2` `v3.0.3` `v3.0.4` `v3.0.5` `v3.0.6` `v3.0.7` `v3.0.8` `v3.0.9` `v3.1.0` `v3.1.0-BETA1` `v3.1.0-RC1` `v3.1.1` `v3.1.10` `v3.1.2` `v3.1.3` `v3.1.4` `v3.1.5` `v3.1.6` `v3.1.7` `v3.1.8` `v3.1.9` `v3.2.0` `v3.2.0-BETA1` `v3.2.0-RC1` `v3.2.0-RC2` `v3.2.1` `v3.2.10` `v3.2.11` `v3.2.12` `v3.2.13` `v3.2.14` `v3.2.2` `v3.2.3` `v3.2.4` `v3.2.5` `v3.2.6` `v3.2.7` `v3.2.8` `v3.2.9` `v3.3.0` `v3.3.0-BETA1` `v3.3.0-RC1` `v3.3.1` `v3.3.10` `v3.3.11` `v3.3.12` `v3.3.13` `v3.3.14` `v3.3.15` `v3.3.16` `v3.3.17` `v3.3.18` `v3.3.2` `v3.3.3` `v3.3.4` `v3.3.5` `v3.3.6` `v3.3.7` `v3.3.8` `v3.3.9` `v3.4.0` `v3.4.0-BETA1` `v3.4.0-BETA2` `v3.4.0-BETA3` `v3.4.0-BETA4` `v3.4.0-RC1` `v3.4.0-RC2` `v3.4.1` `v3.4.10` `v3.4.11` `v3.4.12` `v3.4.13` `v3.4.14` `v3.4.15` `v3.4.16` `v3.4.17` `v3.4.18` `v3.4.19` `v3.4.2` `v3.4.20` `v3.4.21` `v3.4.22` `v3.4.23` `v3.4.24` `v3.4.25` `v3.4.3` `v3.4.4` `v3.4.5` `v3.4.6` `v3.4.7` `v3.4.8` `v3.4.9`
`4.0.0` to before 4.1.12	`4.1.12`Advisories →
Also listed as affected (31) `v4.0.0` `v4.0.1` `v4.0.10` `v4.0.11` `v4.0.12` `v4.0.13` `v4.0.14` `v4.0.15` `v4.0.2` `v4.0.3` `v4.0.4` `v4.0.5` `v4.0.6` `v4.0.7` `v4.0.8` `v4.0.9` `v4.1.0` `v4.1.0-BETA1` `v4.1.0-BETA2` `v4.1.0-BETA3` `v4.1.1` `v4.1.10` `v4.1.11` `v4.1.2` `v4.1.3` `v4.1.4` `v4.1.5` `v4.1.6` `v4.1.7` `v4.1.8` `v4.1.9`
`4.2.0` to before 4.2.7	`4.2.7`Advisories →
Also listed as affected (7) `v4.2.0` `v4.2.1` `v4.2.2` `v4.2.3` `v4.2.4` `v4.2.5` `v4.2.6`

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`8.0.0` to before 8.5.15	`8.5.15`Advisories →
Also listed as affected (80) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8` `8.3.9` `8.4.0` `8.4.0-alpha1` `8.4.0-beta1` `8.4.0-rc1` `8.4.0-rc2` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5` `8.4.6` `8.4.7` `8.4.8` `8.5.0` `8.5.0-alpha1` `8.5.0-beta1` `8.5.0-rc1` `8.5.1` `8.5.10` `8.5.11` `8.5.12` `8.5.13` `8.5.14` `8.5.2` `8.5.3` `8.5.4` `8.5.5` `8.5.6` `8.5.7` `8.5.8` `8.5.9`
`8.6.0` to before 8.6.15	`8.6.15`Advisories →
Also listed as affected (15) `8.6.0` `8.6.1` `8.6.10` `8.6.11` `8.6.12` `8.6.13` `8.6.14` `8.6.2` `8.6.3` `8.6.4` `8.6.5` `8.6.6` `8.6.7` `8.6.8` `8.6.9`

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`8.0.0` to before 8.5.15	`8.5.15`Advisories →
Also listed as affected (80) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8` `8.3.9` `8.4.0` `8.4.0-alpha1` `8.4.0-beta1` `8.4.0-rc1` `8.4.0-rc2` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5` `8.4.6` `8.4.7` `8.4.8` `8.5.0` `8.5.0-alpha1` `8.5.0-beta1` `8.5.0-rc1` `8.5.1` `8.5.10` `8.5.11` `8.5.12` `8.5.13` `8.5.14` `8.5.2` `8.5.3` `8.5.4` `8.5.5` `8.5.6` `8.5.7` `8.5.8` `8.5.9`
`8.6.0` to before 8.6.15	`8.6.15`Advisories →
Also listed as affected (15) `8.6.0` `8.6.1` `8.6.10` `8.6.11` `8.6.12` `8.6.13` `8.6.14` `8.6.2` `8.6.3` `8.6.4` `8.6.5` `8.6.6` `8.6.7` `8.6.8` `8.6.9`

Description

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.