logo

Database

User enumeration In symfony

Description

User enumeration leak using switch user functionality in Symfony An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2019-188862. NVD-2019-188863. OSV-DEBIAN-2019-188864. OSV-2019-188865. GCVE-2019-188866. SECURITY-TRACKER-CVE-2019-18886

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-18886.yaml2. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18886.yaml3. https://github.com/symfony/symfony/releases/tag/v4.3.84. https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality5. https://symfony.com/blog/symfony-4-3-8-released6. https://symfony.com/cve-2019-18886

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.