{"api_version":"1","generated_at":"2026-07-23T09:03:06+00:00","cve":"CVE-2018-11408","urls":{"html":"https://cve.report/CVE-2018-11408","api":"https://cve.report/api/cve/CVE-2018-11408.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-11408","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-11408"},"summary":{"title":"CVE-2018-11408","description":"The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container.  NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-06-13 16:29:00","updated_at":"2023-11-07 02:51:00"},"problem_types":["CWE-601"],"metrics":[],"references":[{"url":"https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers","name":"https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"CVE-2018-11408: Open redirect vulnerability on security handlers (Symfony Blog)","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html","name":"[debian-lts-announce] 20190310 [SECURITY] [DLA 1707-1] symfony security update","refsource":"MLIST","tags":["Third Party Advisory"],"title":"[SECURITY] [DLA 1707-1] symfony security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/","name":"FEDORA-2018-ba0b683c10","refsource":"","tags":[],"title":"[SECURITY] Fedora 28 Update: php-symfony3-3.4.11-1.fc28 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/","name":"FEDORA-2018-ba0b683c10","refsource":"FEDORA","tags":["Third Party Advisory"],"title":"[SECURITY] Fedora 28 Update: php-symfony3-3.4.11-1.fc28 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/","name":"FEDORA-2018-96d770ddc9","refsource":"","tags":[],"title":"[SECURITY] Fedora 28 Update: php-symfony4-4.0.11-1.fc28 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/","name":"FEDORA-2018-96d770ddc9","refsource":"FEDORA","tags":["Third Party Advisory"],"title":"[SECURITY] Fedora 28 Update: php-symfony4-4.0.11-1.fc28 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/","name":"FEDORA-2018-eba0006df2","refsource":"FEDORA","tags":["Third Party Advisory"],"title":"[SECURITY] Fedora 28 Update: php-symfony-2.8.41-1.fc28 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/","name":"FEDORA-2018-eba0006df2","refsource":"","tags":[],"title":"[SECURITY] Fedora 28 Update: php-symfony-2.8.41-1.fc28 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11408","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11408","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"11408","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"11408","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"11408","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sensiolabs","cpe5":"symfony","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"11408","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sensiolabs","cpe5":"symfony","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2018-11408","qid":"994762","title":"PHP (Composer) Security Update for symfony/symfony (GHSA-7hwc-2cq4-6x2w)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2018-11408","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container.  NOTE: this issue exists because of an incomplete fix for CVE-2017-16652."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers","refsource":"CONFIRM","url":"https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers"},{"name":"FEDORA-2018-96d770ddc9","refsource":"FEDORA","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/"},{"name":"FEDORA-2018-ba0b683c10","refsource":"FEDORA","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/"},{"name":"FEDORA-2018-eba0006df2","refsource":"FEDORA","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/"},{"name":"[debian-lts-announce] 20190310 [SECURITY] [DLA 1707-1] symfony security update","refsource":"MLIST","url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html"}]}},"nvd":{"publishedDate":"2018-06-13 16:29:00","lastModifiedDate":"2023-11-07 02:51:00","problem_types":["CWE-601"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"2.7.0","versionEndExcluding":"2.7.48","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"2.8.0","versionEndExcluding":"2.8.41","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3.0","versionEndExcluding":"3.3.17","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.0","versionEndExcluding":"3.4.11","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.11","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"11408","Ordinal":"127885","Title":"CVE-2018-11408","CVE":"CVE-2018-11408","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"11408","Ordinal":"1","NoteData":"The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container.  NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"11408","Ordinal":"2","NoteData":"2018-06-13","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"11408","Ordinal":"3","NoteData":"2019-03-10","Type":"Other","Title":"Modified"}]}}}