Description

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

Remediation

References

CVE-2019-10909

Related Vulnerabilities

WordPress Plugin WP Post Popup Directory Traversal (2.0)

Ruby on Rails Missing Encryption of Sensitive Data Vulnerability (CVE-2010-3299)

MySQL CVE-2019-2585 Vulnerability (CVE-2019-2585)

WordPress Plugin WP Accurate Form Data Multiple Vulnerabilities (1.2)

Artifactory Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2018-1000623)

Severity

Medium

Classification

CVE-2019-10909 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities