An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The     current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP     and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context     to do CSRF attacks. (CVE-2017-16653)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The
    current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP
    and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context
    to do CSRF attacks. (CVE-2017-16653)

Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to open redirects, cross-site request forgery, information disclosure, session fixation or denial of service.

ID	Name	Product	Family	Severity
254530	Linux Distros Unpatched Vulnerability : CVE-2017-16653	Nessus	Misc.	medium
433789	SCA: security update for symfony/security, symfony/security-csrf, symfony/symfony (GHSA-92x6-h2gr-8gxq)	Tenable Cloud Security	SCA Checks	medium
433789	SCA: security update for symfony/security, symfony/security-csrf, symfony/symfony (GHSA-92x6-h2gr-8gxq)	Tenable Self-Hosted Container Security	SCA Checks	medium
111535	Debian DSA-4262-1 : symfony - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-16653

medium

Tenable Plugins

medium

medium

medium

critical