p PatchFirst

PatchFirst · Latest vulnerabilities

symfony/security-csrf vulnerabilities

Vulnerabilities published for symfony/security-csrf in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 1

  1. CVE-2017-16653

    Medium · CVSS 5.9EPSS 1.49%Fix available

    CVE-2017-16653

    An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.

    symfony/security-csrf symfony/security-csrf symfony/security-csrf symfony/security-csrfPHP
    • Update to 2.7.38
    • Update to 2.8.31
    • Update to 3.2.14
    • Update to 3.3.13
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →