Vulnerability Details CVE-2017-16654
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read() methods of these classes use a path and a locale to determine the language bundle to retrieve. The locale argument value is commonly retrieved from untrusted user input (like a URL parameter). An attacker can use this argument to navigate to arbitrary directories via the dot-dot-slash attack, aka Directory Traversal.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 67.7%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- https://github.com/symfony/symfony/pull/24994
- https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
- https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths
- https://www.debian.org/security/2018/dsa-4262
- https://github.com/symfony/symfony/pull/24994
- https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
- https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths
- https://www.debian.org/security/2018/dsa-4262
Products affected by CVE-2017-16654
-
cpe:2.3:a:sensiolabs:symfony:*
-
cpe:2.3:a:sensiolabs:symfony:2.7.0
-
cpe:2.3:a:sensiolabs:symfony:2.7.1
-
cpe:2.3:a:sensiolabs:symfony:2.7.10
-
cpe:2.3:a:sensiolabs:symfony:2.7.11
-
cpe:2.3:a:sensiolabs:symfony:2.7.12
-
cpe:2.3:a:sensiolabs:symfony:2.7.13
-
cpe:2.3:a:sensiolabs:symfony:2.7.14
-
cpe:2.3:a:sensiolabs:symfony:2.7.15
-
cpe:2.3:a:sensiolabs:symfony:2.7.16
-
cpe:2.3:a:sensiolabs:symfony:2.7.17
-
cpe:2.3:a:sensiolabs:symfony:2.7.18
-
cpe:2.3:a:sensiolabs:symfony:2.7.19
-
cpe:2.3:a:sensiolabs:symfony:2.7.2
-
cpe:2.3:a:sensiolabs:symfony:2.7.20
-
cpe:2.3:a:sensiolabs:symfony:2.7.21
-
cpe:2.3:a:sensiolabs:symfony:2.7.22
-
cpe:2.3:a:sensiolabs:symfony:2.7.23
-
cpe:2.3:a:sensiolabs:symfony:2.7.24
-
cpe:2.3:a:sensiolabs:symfony:2.7.25
-
cpe:2.3:a:sensiolabs:symfony:2.7.26
-
cpe:2.3:a:sensiolabs:symfony:2.7.27
-
cpe:2.3:a:sensiolabs:symfony:2.7.28
-
cpe:2.3:a:sensiolabs:symfony:2.7.29
-
cpe:2.3:a:sensiolabs:symfony:2.7.3
-
cpe:2.3:a:sensiolabs:symfony:2.7.30
-
cpe:2.3:a:sensiolabs:symfony:2.7.31
-
cpe:2.3:a:sensiolabs:symfony:2.7.32
-
cpe:2.3:a:sensiolabs:symfony:2.7.33
-
cpe:2.3:a:sensiolabs:symfony:2.7.34
-
cpe:2.3:a:sensiolabs:symfony:2.7.35
-
cpe:2.3:a:sensiolabs:symfony:2.7.36
-
cpe:2.3:a:sensiolabs:symfony:2.7.37
-
cpe:2.3:a:sensiolabs:symfony:2.7.4
-
cpe:2.3:a:sensiolabs:symfony:2.7.5
-
cpe:2.3:a:sensiolabs:symfony:2.7.6
-
cpe:2.3:a:sensiolabs:symfony:2.7.7
-
cpe:2.3:a:sensiolabs:symfony:2.7.8
-
cpe:2.3:a:sensiolabs:symfony:2.7.9
-
cpe:2.3:a:sensiolabs:symfony:3.2.0
-
cpe:2.3:a:sensiolabs:symfony:3.2.1
-
cpe:2.3:a:sensiolabs:symfony:3.2.10
-
cpe:2.3:a:sensiolabs:symfony:3.2.11
-
cpe:2.3:a:sensiolabs:symfony:3.2.12
-
cpe:2.3:a:sensiolabs:symfony:3.2.13
-
cpe:2.3:a:sensiolabs:symfony:3.2.2
-
cpe:2.3:a:sensiolabs:symfony:3.2.3
-
cpe:2.3:a:sensiolabs:symfony:3.2.4
-
cpe:2.3:a:sensiolabs:symfony:3.2.5
-
cpe:2.3:a:sensiolabs:symfony:3.2.6
-
cpe:2.3:a:sensiolabs:symfony:3.2.7
-
cpe:2.3:a:sensiolabs:symfony:3.2.8
-
cpe:2.3:a:sensiolabs:symfony:3.2.9
-
cpe:2.3:a:sensiolabs:symfony:3.3.0
-
cpe:2.3:a:sensiolabs:symfony:3.3.1
-
cpe:2.3:a:sensiolabs:symfony:3.3.10
-
cpe:2.3:a:sensiolabs:symfony:3.3.11
-
cpe:2.3:a:sensiolabs:symfony:3.3.12
-
cpe:2.3:a:sensiolabs:symfony:3.3.2
-
cpe:2.3:a:sensiolabs:symfony:3.3.3
-
cpe:2.3:a:sensiolabs:symfony:3.3.4
-
cpe:2.3:a:sensiolabs:symfony:3.3.5
-
cpe:2.3:a:sensiolabs:symfony:3.3.6
-
cpe:2.3:a:sensiolabs:symfony:3.3.7
-
cpe:2.3:a:sensiolabs:symfony:3.3.8
-
cpe:2.3:a:sensiolabs:symfony:3.3.9
-
cpe:2.3:o:debian:debian_linux:8.0
-
cpe:2.3:o:debian:debian_linux:9.0