{"id":"CVE-2017-18343","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-18343","generatedAt":"2026-10-29T01:42:50.092Z","title":"The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI.","description":"The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar","published":"2018-07-20T00:29:00.000Z","lastModified":"2026-06-17T01:12:39.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["sensiolabs/symfony"],"epss":{"score":0.06107,"percentile":0.93392,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.14162,"percentile":0.96469},{"date":"2026-09-22","score":0.06107,"percentile":0.93108}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (6.11%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-21T00:00:00.000Z","detail":{"to":0.14162,"from":0.06107,"percentile":0.96469},"summary":"EPSS moved from 6.1% to 14.2% probability of exploitation in the next thirty days."}],"references":[{"url":"https://github.com/barryvdh/laravel-debugbar/issues/850","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/symfony/debug/pull/7/commits/e48bda29143bd1a83001780b4a78e483822d985c","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/symfony/symfony/issues/27987","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/symfony/symfony/pull/23684","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/barryvdh/laravel-debugbar/issues/850","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/symfony/debug/pull/7/commits/e48bda29143bd1a83001780b4a78e483822d985c","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/symfony/symfony/issues/27987","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/symfony/symfony/pull/23684","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-18343","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}