PatchTheCVEgetsymphony vulnerabilities
Recent CVEs affecting getsymphony products. 9 tracked.
getsymphony has 9 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2021-10-31. Highest priority: CVE-2020-25912 (score 60/100).
- CVE-2020-25912 CRITICAL 9.1 DOWNGRADE A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symph
- CVE-2020-25343 MEDIUM 5.4 DOWNGRADE Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary we
- CVE-2020-15071 MEDIUM 6.1 DOWNGRADE content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading.
- CVE-2018-12043 MEDIUM 6.1 DOWNGRADE content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.
- CVE-2017-8876 MEDIUM 6.1 DOWNGRADE Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.
- CVE-2017-7694 HIGH 8.8 UPGRADE Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS thro
- CVE-2017-6067 MEDIUM 6.1 DOWNGRADE Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field.
- CVE-2017-5542 MEDIUM 6.1 UPGRADE Cross-site scripting (XSS) vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.
- CVE-2017-5541 MEDIUM 5.3 UPGRADE Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 al
FAQ
How do I fix getsymphony vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is getsymphony being exploited right now?
None of the tracked getsymphony CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which getsymphony CVE should I patch first?
CVE-2020-25912 currently ranks highest (60/100): A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symph.