User enumeration leak using switch user functionality in Symfony
An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-18886US | medium5.3 | — | ||
An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed w… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-18886.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18886.yamlWEB
- https://github.com/symfony/symfony/releases/tag/v4.3.8WEB
- https://nvd.nist.gov/vuln/detail/CVE-2019-18886ADVISORY
- https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionalityWEB
- https://symfony.com/blog/symfony-4-3-8-releasedWEB
- https://symfony.com/cve-2019-18886WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan