CVE-2017-18343

Name	CVE-2017-18343
Description	The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
symfony (PTS)	bullseye	4.4.19+dfsg-2+deb11u6	fixed
	bookworm	5.4.23+dfsg-1+deb12u2	fixed
	bookworm (security)	5.4.23+dfsg-1+deb12u4	fixed
	sid, trixie	6.4.16+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
symfony	source	(unstable)	3.4.0+dfsg-1	unimportant

Notes

https://github.com/symfony/debug/pull/7/commits/e48bda29143bd1a83001780b4a78e483822d985c
https://github.com/symfony/symfony/issues/27987
https://github.com/symfony/symfony/pull/23684