CVE-2018-19790: debian debian_linux Open Redirect
Vulnerability summary
CVE-2018-19790 is a medium (CVSS 6.1) Open Redirect vulnerability in debian debian_linux. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 73.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 18-12-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.49%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.49% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- symfony< 3.4.20+dfsg-1
- debian_linuxEOL8.0
Fedoraproject1 product
- fedoraEOL28
Sensiolabs1 product
- symfony≥ 2.7.0, < 2.7.50 | ≥ 2.8.0, < 2.8.49 | ≥ 3.0.0, < 3.4.20 | ≥ 4.0.0, < 4.0.15 | ≥ 4.1.0, < 4.1.9 | ≥ 4.2.0, < 4.2.1
Ubuntu1 product
- symfonyAll versions (No fix recorded)
4 vendors · 5 products
References
11 links
lists.debian.org/debian-lts-announce/2019/03/msg00009.htmlMailing ListX Refsource MLISTThird Party Advisory- symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-when-using-security-httpX Refsource CONFIRMPatchVendor AdvisoryREPORT