CVE-2017-16654

2018-08-06 23:29:00 2019-03-13 18:56:32

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read() methods of these classes use a path and a locale to determine the language bundle to retrieve. The locale argument value is commonly retrieved from untrusted user input (like a URL parameter). An attacker can use this argument to navigate to arbitrary directories via the dot-dot-slash attack, aka Directory Traversal.

Vector

NETWORK

Complexity

LOW

Authentication

NONE

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE
Sensiolabs Symfony 3.3.12 (not an official CPE) Sensiolabs Symfony 3.3.11 (not an official CPE) Sensiolabs Symfony 3.3.10 (not an official CPE) Sensiolabs Symfony 3.3.9 (not an official CPE) Sensiolabs Symfony 3.3.8 (not an official CPE) Sensiolabs Symfony 3.3.7 (not an official CPE) Sensiolabs Symfony 3.3.6 (not an official CPE) Sensiolabs Symfony 3.3.5 (not an official CPE) Sensiolabs Symfony 3.3.4 (not an official CPE) Sensiolabs Symfony 3.3.3 (not an official CPE) Sensiolabs Symfony 3.3.2 (not an official CPE) Sensiolabs Symfony 3.3.1 (not an official CPE) Sensiolabs Symfony 3.3.0 Rc1 (not an official CPE) Sensiolabs Symfony 3.3.0 Beta1 (not an official CPE) Sensiolabs Symfony 3.3.0 (not an official CPE) Sensiolabs Symfony 3.2.13 (not an official CPE) Sensiolabs Symfony 3.2.12 (not an official CPE) Sensiolabs Symfony 3.2.11 (not an official CPE) Sensiolabs Symfony 3.2.10 (not an official CPE) Sensiolabs Symfony 3.2.9 (not an official CPE) Sensiolabs Symfony 3.2.8 (not an official CPE) Sensiolabs Symfony 3.2.7 (not an official CPE) Sensiolabs Symfony 3.2.6 (not an official CPE) Sensiolabs Symfony 3.2.5 (not an official CPE) Sensiolabs Symfony 3.2.4 (not an official CPE) Sensiolabs Symfony 3.2.3 (not an official CPE) Sensiolabs Symfony 3.2.2 (not an official CPE) Sensiolabs Symfony 3.2.1 (not an official CPE) Sensiolabs Symfony 3.2.0 Rc2 (not an official CPE) Sensiolabs Symfony 3.2.0 Rc1 (not an official CPE) Sensiolabs Symfony 3.2.0 Beta1 (not an official CPE) Sensiolabs Symfony 3.2.0 (not an official CPE) Sensiolabs Symfony 2.7.37 (not an official CPE) Sensiolabs Symfony 2.7.36 (not an official CPE) Sensiolabs Symfony 2.7.35 (not an official CPE) Sensiolabs Symfony 2.7.34 (not an official CPE) Sensiolabs Symfony 2.7.33 (not an official CPE) Sensiolabs Symfony 2.7.32 (not an official CPE) Sensiolabs Symfony 2.7.31 (not an official CPE) Sensiolabs Symfony 2.7.30 (not an official CPE) Sensiolabs Symfony 2.7.29 (not an official CPE) Sensiolabs Symfony 2.7.28 (not an official CPE) Sensiolabs Symfony 2.7.27 (not an official CPE) Sensiolabs Symfony 2.7.26 (not an official CPE) Sensiolabs Symfony 2.7.25 (not an official CPE) Sensiolabs Symfony 2.7.24 (not an official CPE) Sensiolabs Symfony 2.7.23 (not an official CPE) Sensiolabs Symfony 2.7.22 (not an official CPE) Sensiolabs Symfony 2.7.21 (not an official CPE) Sensiolabs Symfony 2.7.20 (not an official CPE) Sensiolabs Symfony 2.7.19 (not an official CPE) Sensiolabs Symfony 2.7.18 (not an official CPE) Sensiolabs Symfony 2.7.17 (not an official CPE) Sensiolabs Symfony 2.7.16 (not an official CPE) Sensiolabs Symfony 2.7.15 (not an official CPE) Sensiolabs Symfony 2.7.14 (not an official CPE) Sensiolabs Symfony 2.7.13 (not an official CPE) Sensiolabs Symfony 2.7.12 (not an official CPE) Sensiolabs Symfony 2.7.11 (not an official CPE) Sensiolabs Symfony 2.7.10 (not an official CPE) Sensiolabs Symfony 2.7.9 (not an official CPE) Sensiolabs Symfony 2.7.8 (not an official CPE) Sensiolabs Symfony 2.7.7 (not an official CPE) Sensiolabs Symfony 2.7.6 (not an official CPE) Sensiolabs Symfony 2.7.5 (not an official CPE) Sensiolabs Symfony 2.7.4 (not an official CPE) Sensiolabs Symfony 2.7.3 (not an official CPE) Sensiolabs Symfony 2.7.2 (not an official CPE) Sensiolabs Symfony 2.7.1 (not an official CPE) Sensiolabs Symfony 2.7.0 Beta2 (not an official CPE) Sensiolabs Symfony 2.7.0 Beta1 (not an official CPE) Sensiolabs Symfony 2.7.0 (not an official CPE)