CVE-2018-19790

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.

• CWE-601

• http://www.securityfocus.com/bid/106249Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2019/03/msg00009.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ/
• https://seclists.org/bugtraq/2019/May/21
• https://symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-when-using-security-httpPatch, Vendor Advisory
• https://www.debian.org/security/2019/dsa-4441
• http://www.securityfocus.com/bid/106249Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2019/03/msg00009.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ/
• https://seclists.org/bugtraq/2019/May/21
• https://symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-when-using-security-httpPatch, Vendor Advisory
• https://www.debian.org/security/2019/dsa-4441

Published

Dec 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19784The str_rot_pass function in vendor/atholn1600/php-proxy/src…
• CVE-2018-19785PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via t…
• CVE-2018-19786HashiCorp Vault before 1.0.0 writes the master key to the se…
• CVE-2018-19787An issue was discovered in lxml before 4.2.5. lxml/html/clea…6.1
• CVE-2018-19788A flaw was found in PolicyKit (aka polkit) 0.115 that allows…
• CVE-2018-19789An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.…
• CVE-2018-19791The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does …
• CVE-2018-19792The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allow…
• CVE-2018-19793jiacrontab 1.4.5 allows remote attackers to execute arbitrar…
• CVE-2018-19794Cross-site scripting (XSS) vulnerability in UiV2Public.index…
• CVE-2018-19795ChipsBank UMPTool saves the password to the NAND with a simp…
• CVE-2018-19796An open redirect in the Ninja Forms plugin before 3.3.19.1 f…