Symfony Open Redirect
Moderate severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated Feb 7, 2024
Package
Affected versions
>= 2.7.0, < 2.7.38
>= 2.8.0, < 2.8.31
>= 3.2.0, < 3.2.14
>= 3.3.0, < 3.3.13
Patched versions
2.7.38
2.8.31
3.2.14
3.3.13
>= 2.7.0, < 2.7.38
>= 2.8.0, < 2.8.31
>= 3.2.0, < 3.2.14
>= 3.3.0, < 3.3.13
2.7.38
2.8.31
3.2.14
3.3.13
>= 2.7.0, < 2.7.38
>= 2.8.0, < 2.8.31
>= 3.2.0, < 3.2.14
>= 3.3.0, < 3.3.13
2.7.38
2.8.31
3.2.14
3.3.13
Description
Published by the National Vulnerability Database
Jun 13, 2018
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
Jul 26, 2023
Last updated
Feb 7, 2024
An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13.
DefaultAuthenticationSuccessHandlerorDefaultAuthenticationFailureHandlertakes the content of the_target_pathparameter and generates a redirect response, but no check is performed on the path, which could be an absolute URL to an external domain. This Open redirect vulnerability can be exploited for example to mount effective phishing attacks.References