PatchTheCVEsymphony vulnerabilities and fixes
Recent CVEs affecting symphony, with upgrade or downgrade steps. 14 tracked.
symphony has 14 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2021-10-31. Highest priority: CVE-2020-25912 (score 60/100).
- CVE-2020-25912 CRITICAL 9.1 DOWNGRADE A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symph
- CVE-2020-25343 MEDIUM 5.4 DOWNGRADE Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary we
- CVE-2020-17405 HIGH 8.8 DOWNGRADE This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Se
- CVE-2020-15071 MEDIUM 6.1 DOWNGRADE content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading.
- CVE-2019-9142 MEDIUM 6.1 UPGRADE An issue was discovered in b3log Symphony (aka Sym) before v3.4.7
- CVE-2019-17488 MEDIUM 6.1 UPGRADE b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.
- CVE-2018-16249 MEDIUM 4.8 UPGRADE In Symphony before 3.3.0, there is XSS in the Title under Post
- CVE-2018-12043 MEDIUM 6.1 DOWNGRADE content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.
- CVE-2017-8876 MEDIUM 6.1 DOWNGRADE Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.
- CVE-2017-7694 HIGH 8.8 UPGRADE Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS thro
- CVE-2017-6067 MEDIUM 6.1 DOWNGRADE Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field.
- CVE-2017-16956 MEDIUM 6.1 DOWNGRADE b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, a
- CVE-2017-16881 MEDIUM 6.1 DOWNGRADE b3log Symphony (aka Sym) 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted use
- CVE-2017-16821 MEDIUM 5.4 DOWNGRADE b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated
FAQ
How do I fix symphony vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is symphony being exploited right now?
None of the tracked symphony CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which symphony CVE should I patch first?
CVE-2020-25912 currently ranks highest (60/100): A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symph.