CVE-2019-20058

Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the _profiler page

published December 29, 2019

CVSS
—
EPSS
1%
Percentile
52.6
In the wild
Unconfirmed
What it is

Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the _profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is related to CVE-2018-12040

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00700 · 52.6th percentile
Published
2019-12-29T18:50Z
EPSS history
Timeline
  • 29 DEC 18:50Z
    Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the _profiler page
    cvelistv5