-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly names DefaultAuthenticationSuccessHandler and DefaultAuthenticationFailureHandler as the components that improperly handled _target_path parameters. Both handlers' determineTargetUrl methods would be responsible for processing this parameter and generating redirects. The lack of validation for absolute URLs to external domains in these methods directly enables the open redirect vulnerability. The functions are clearly identified in Symfony's security advisory and CVE description as the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/symfony | composer | >= 2.7.0, < 2.7.38 | 2.7.38 |
| symfony/symfony | composer | >= 2.8.0, < 2.8.31 | 2.8.31 |
| symfony/symfony | composer | >= 3.2.0, < 3.2.14 | 3.2.14 |
| symfony/symfony | composer | >= 3.3.0, < 3.3.13 | 3.3.13 |
| symfony/security-http | composer | >= 2.7.0, < 2.7.38 | 2.7.38 |
| symfony/security-http | composer | >= 2.8.0, < 2.8.31 | 2.8.31 |
| symfony/security-http | composer | >= 3.2.0, < 3.2.14 | 3.2.14 |
| symfony/security-http | composer | >= 3.3.0, < 3.3.13 | 3.3.13 |
| symfony/security | composer | >= 2.7.0, < 2.7.38 | 2.7.38 |
| symfony/security | composer | >= 2.8.0, < 2.8.31 | 2.8.31 |
| symfony/security | composer | >= 3.2.0, < 3.2.14 | 3.2.14 |
| symfony/security | composer | >= 3.3.0, < 3.3.13 | 3.3.13 |
A Semantic Attack on Google Gemini - Read the Latest Research