An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one array. This big array forms the data that are then bound to the form. At this stage there is no difference anymore between submitted POST data and uploaded files. A user can send a crafted HTTP request where the value of a "FileType" is sent as normal POST data that could be interpreted as a local file path on the server-side (for example, "file:///etc/passwd"). If the application did not perform any additional checks about the value submitted to the "FileType", the contents of the given file on the server could have been exposed to the attacker.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a     form is submitted by the user, the request handler classes of the Form component merge POST data and     uploaded files data into one array. This big array forms the data that are then bound to the form. At this     stage there is no difference anymore between submitted POST data and uploaded files. A user can send a     crafted HTTP request where the value of a FileType is sent as normal POST data that could be interpreted     as a local file path on the server-side (for example, file:///etc/passwd). If the application did not     perform any additional checks about the value submitted to the FileType, the contents of the given file     on the server could have been exposed to the attacker. (CVE-2017-16790)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a
    form is submitted by the user, the request handler classes of the Form component merge POST data and
    uploaded files data into one array. This big array forms the data that are then bound to the form. At this
    stage there is no difference anymore between submitted POST data and uploaded files. A user can send a
    crafted HTTP request where the value of a "FileType" is sent as normal POST data that could be interpreted
    as a local file path on the server-side (for example, "file:///etc/passwd"). If the application did not
    perform any additional checks about the value submitted to the "FileType", the contents of the given file
    on the server could have been exposed to the attacker. (CVE-2017-16790)

Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to open redirects, cross-site request forgery, information disclosure, session fixation or denial of service.

ID	Name	Product	Family	Severity
256002	Linux Distros Unpatched Vulnerability : CVE-2017-16790	Nessus	Misc.	medium
434219	SCA: security update for symfony/form, symfony/symfony (GHSA-cqqh-94r6-wjrg)	Tenable Cloud Security	SCA Checks	medium
434219	SCA: security update for symfony/form, symfony/symfony (GHSA-cqqh-94r6-wjrg)	Tenable Self-Hosted Container Security	SCA Checks	medium
111535	Debian DSA-4262-1 : symfony - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-16790

medium

Tenable Plugins

medium

medium

medium

critical