CVE-2017-18343 Cross-site scripting in n/a

What is CVE-2017-18343?

CVE-2017-18343 is a medium-severity cross-site scripting vulnerability in Sensiolabs Symfony, published on 20 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar

Weakness: CWE-79

Which versions are affected by CVE-2017-18343?

It affects 1 product.

Products include Sensiolabs Symfony.

How do I fix CVE-2017-18343?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-18343 being exploited?

There is no known exploitation of CVE-2017-18343 in the wild and no public exploit code.

Other vulnerabilities in Sensiolabs Symfony

• CVE-2019-11325 Improper Input Validation in Symfony Critical 9.8
• CVE-2017-11365 Symfony Incorrect Access Control Critical 9.8
• CVE-2019-10913 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony Critical 9.8
• CVE-2018-11407 Symfony Authentication Bypass Critical 9.8
• CVE-2016-2403 Symfony Authentication Bypass Critical 9.8

All Sensiolabs Symfony vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-18343, GHSA-mm4c-ww47-3x4c.