CVE-2019-18886
- Source
- https://cve.org/CVERecord?id=CVE-2019-18886
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-18886.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2019-18886
- Aliases
- Downstream
- Published
- 2019-11-21T18:15:11Z
- Modified
- 2026-08-03T14:24:01Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security.
- References
Affected packages
Git / github.com/symfony/security-http
Affected ranges
- Type
- GIT
- Repo
- https://github.com/symfony/security-http
- Events
-
IntroducedLast AffectedIntroducedLast Affected
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "4.2.0" }, { "last_affected": "4.2.11" }, { "introduced": "4.3.0" }, { "last_affected": "4.3.7" } ], "source": "CPE_RANGE" }
Git / github.com/symfony/symfony
Affected versions
v2.*
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.0-RC5
v2.0.0-RC6
v2.0.0BETA1
v2.0.0BETA2
v2.0.0BETA3
v2.0.0BETA4
v2.0.0BETA5
v2.0.0PR8
v2.1.0
v2.1.0-BETA1
v2.1.0-BETA2
v2.1.0-BETA3
v2.1.0-BETA4
v2.1.0-RC1
v2.1.0-RC2
v2.2.0-BETA1
v2.2.0-BETA2
v2.3.0-BETA1
v2.3.0-BETA2
v2.4.0-BETA1
v2.4.0-BETA2
v2.5.0-BETA1
v2.5.0-BETA2
v2.6.0-BETA1
v3.*
v3.0.0
v3.0.0-BETA1
v3.2.0-BETA1
v3.2.0-RC1
v3.3.0-BETA1
v4.*
v4.0.0-BETA1
v4.0.0-BETA2
v4.0.0-BETA3
v4.0.0-BETA4
v4.2.0-BETA1
v4.2.0-BETA2
v4.3.0
v4.3.0-BETA1
v4.3.0-BETA2
v4.3.0-RC1
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7
Other
vPR3
vPR4
vPR5
vPR6
vPR8
vPR9