CVE-2017-18343

The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar

• CWE-79

• https://github.com/barryvdh/laravel-debugbar/issues/850Exploit, Third Party Advisory
• https://github.com/symfony/debug/pull/7/commits/e48bda29143bd1a83001780b4a78e483822d985cPatch, Third Party Advisory
• https://github.com/symfony/symfony/issues/27987Exploit, Third Party Advisory
• https://github.com/symfony/symfony/pull/23684Third Party Advisory
• https://github.com/barryvdh/laravel-debugbar/issues/850Exploit, Third Party Advisory
• https://github.com/symfony/debug/pull/7/commits/e48bda29143bd1a83001780b4a78e483822d985cPatch, Third Party Advisory
• https://github.com/symfony/symfony/issues/27987Exploit, Third Party Advisory
• https://github.com/symfony/symfony/pull/23684Third Party Advisory

Published

Jul 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18338Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-18339Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-1834Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18340Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-18341Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-18342In PyYAML before 5.1, the yaml.load() API could execute arbi…9.8
• CVE-2017-18344The timer_create syscall implementation in kernel/time/posix…
• CVE-2017-18345The Joomanager component through 2.0.0 for Joomla! has an ar…
• CVE-2017-18346SQL injection vulnerability in /wbg/core/_includes/authoriza…
• CVE-2017-18347Incorrect access control in RDP Level 1 on STMicroelectronic…4.6
• CVE-2017-18348Splunk Enterprise 6.6.x, when configured to run as root but …
• CVE-2017-18349parseObject in Fastjson before 1.2.25, as used in FastjsonEn…