What is CVE-2017-18343?

CVE-2017-18343 is a medium-severity vulnerability in Sensiolabs Symfony, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2018-07-20.

How severe is CVE-2017-18343?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Sensiolabs Symfony

CVE-2017-18343

The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.061 (92.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Sensiolabs Symfony
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-18343?: CVE-2017-18343 is a medium-severity vulnerability in Sensiolabs Symfony, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2018-07-20.
How severe is CVE-2017-18343?: Medium severity. CVSS v3 base score is 6.1 out of 10.