CVE-2018-12040 Cross-site scripting in n/a

What is CVE-2018-12040?

CVE-2018-12040 is a medium-severity cross-site scripting vulnerability in Sensiolabs Symfony, published on 13 Jun 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI. NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don't handle those issues as security issues).

Weakness: CWE-79

Which versions are affected by CVE-2018-12040?

It affects 1 product.

Products include Sensiolabs Symfony.

How do I fix CVE-2018-12040?

Change a configuration setting.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-12040 being exploited?

There is no known exploitation of CVE-2018-12040 in the wild and no public exploit code.

Other vulnerabilities in Sensiolabs Symfony

• CVE-2019-11325 Improper Input Validation in Symfony Critical 9.8
• CVE-2017-11365 Symfony Incorrect Access Control Critical 9.8
• CVE-2019-10913 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony Critical 9.8
• CVE-2018-11407 Symfony Authentication Bypass Critical 9.8
• CVE-2016-2403 Symfony Authentication Bypass Critical 9.8

All Sensiolabs Symfony vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2018-12040, GHSA-mjcw-3g32-5p52.