Description

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

Remediation

References

CVE-2019-10909

Related Vulnerabilities

Apache HTTP Server Out-of-bounds Read Vulnerability (CVE-2023-31122)

Drupal Core 8.8.x Cross-Site Request Forgery (8.8.0 - 8.8.7)

osCommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-43725)

Oracle Application Server Credentials Management Errors Vulnerability (CVE-2002-2345)

WordPress Plugin WP Mailto Links-Manage Email Links Cross-Site Scripting (2.0.1)

Severity

Medium

Classification

CVE-2019-10909 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities