*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4.
Laravel Dusk provides simple end-to-end testing and browser automation.
Library home page: https://api.github.com/repos/laravel/dusk/zipball/a7529e19592879d3a6408728080ba657499890bc
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2019-18887
### Vulnerable Library - symfony/http-kernel-v3.4.2The HttpKernel component provides a structured process for converting a Request into a Response.
Dependency Hierarchy: - laravel/dusk-v2.0.8 (Root Library) - symfony/console-v3.4.2 - symfony/debug-v3.4.2 - :x: **symfony/http-kernel-v3.4.2** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsAn issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
Publish Date: 2019-11-21
URL: CVE-2019-18887
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://symfony.com/blog/symfony-4-3-8-released
Release Date: 2019-11-21
Fix Resolution: 2.8.52, 3.4.35, 4.2.12, 4.3.8
CVE-2018-14774
### Vulnerable Library - symfony/http-kernel-v3.4.2The HttpKernel component provides a structured process for converting a Request into a Response.
Dependency Hierarchy: - laravel/dusk-v2.0.8 (Root Library) - symfony/console-v3.4.2 - symfony/debug-v3.4.2 - :x: **symfony/http-kernel-v3.4.2** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsAn issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.
Publish Date: 2018-08-03
URL: CVE-2018-14774
### CVSS 3 Score Details (7.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14774
Release Date: 2018-08-03
Fix Resolution: v2.8.44,v3.3.18,v3.4.14
CVE-2020-11023
### Vulnerable Library - laravel/dusk-v2.0.8Laravel Dusk provides simple end-to-end testing and browser automation.
Library home page: https://api.github.com/repos/laravel/dusk/zipball/a7529e19592879d3a6408728080ba657499890bc
Dependency Hierarchy: - :x: **laravel/dusk-v2.0.8** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing
### CVSS 3 Score Details (6.9)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440
Release Date: 2020-04-29
Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0
CVE-2019-11358
### Vulnerable Library - laravel/dusk-v2.0.8Laravel Dusk provides simple end-to-end testing and browser automation.
Library home page: https://api.github.com/repos/laravel/dusk/zipball/a7529e19592879d3a6408728080ba657499890bc
Dependency Hierarchy: - :x: **laravel/dusk-v2.0.8** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsjQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Publish Date: 2019-04-20
URL: CVE-2019-11358
### CVSS 3 Score Details (6.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358
Release Date: 2019-04-20
Fix Resolution: jquery - 3.4.0
CVE-2022-24894
### Vulnerable Library - symfony/http-kernel-v3.4.2The HttpKernel component provides a structured process for converting a Request into a Response.
Dependency Hierarchy: - laravel/dusk-v2.0.8 (Root Library) - symfony/console-v3.4.2 - symfony/debug-v3.4.2 - :x: **symfony/http-kernel-v3.4.2** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsSymfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4.
Publish Date: 2023-02-03
URL: CVE-2022-24894
### CVSS 3 Score Details (5.9)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://symfony.com/blog/cve-2022-24894-prevent-storing-cookie-headers-in-httpcache
Release Date: 2022-02-11
Fix Resolution: v4.4.50, v5.4.20, v6.0.20, v6.1.12, v6.2.6