CVE-2017-18343

Public exploit available. Not confirmed exploited in the wild yet. Fixed in 2.7.33.

CVSS 3.06.1Medium EPSS percentile93rd6.1% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources Fix2.7.33Upgrade to this build

Published 2018-07-20Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Sensiolabs SymfonyAffected: < 2.7.33Upgrade to: 2.7.33Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your live site uses Symfony debug tools or Laravel Debugbar, and identify its Symfony version.
Remove or disable debug tools on internet-facing production systems while you arrange the update.
Upgrade Symfony to 2.7.33 or later; for newer release branches, use 2.8.26, 3.2.13, or 3.3.6 or later.
Test error handling after the update, then confirm debug pages are no longer publicly reachable.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar

In plain language

Written by AI from the record

Older Symfony debug tools can let a malicious error message run code in a visitor’s browser, so businesses that expose them on a live site should update.

Reflected XSS in Symfony’s debug exception handler occurs when an attacker-controlled array key is rendered during exception pretty-printing.

If you're affected

Browser session theft
Unauthorized actions as users
Sensitive page data exposure
Damaged customer trust

What is it

This is a flaw in a developer-facing error screen. It is like leaving a staff-only noticeboard where a hostile note can make a visitor’s browser follow the attacker’s instructions instead of simply displaying the note.

Who is affected

This matters to you if you run Symfony with its debug tools on a production website, including applications that use Laravel Debugbar. It is only a risk when the debug error output is reachable by someone who can cause or supply the displayed content.

How urgent is it

Public proof-of-concept code exists, making this a practical issue for exposed debug pages. It is not listed in CISA’s catalog of vulnerabilities known to be actively exploited, so treat this as an important scheduled remediation: disable public debug access now and update promptly.

What to do — in detail

Confirm whether production hosts include Symfony’s Debug component or Laravel Debugbar, whether debug mode is enabled, and whether debug endpoints or exception pages can be reached from outside the organization. Inspect the deployed dependency lockfile or package inventory to determine the installed Symfony branch and version.

Upgrade the affected branch to its fixed release: 2.7.x to 2.7.33 or later, 2.8.x to 2.8.26 or later, 3.0–3.2.x to 3.2.13 or later, and 3.3.x to 3.3.6 or later. Moving between major Symfony versions may require application compatibility work; a same-branch update is the least disruptive initial path.

If patching is delayed, ensure debug mode and Laravel Debugbar are disabled in production and restrict any residual debug endpoints to trusted administrative networks. Review web-server logs for requests to debug-related paths, particularly /_debugbar/open?op=get, and investigate unexpected error-page requests containing script-like input. No CISA KEV remediation due date applies because this CVE is not listed in KEV.

Technical context

CVE-2017-18343 is CWE-79 reflected XSS with CVSS 3.0 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The trigger is an attacker-controlled array key rendered by ExceptionHandler.php during debug exception pretty-printing; public GitHub PoCs are known. EPSS predicts elevated likelihood at 14.2% (96th percentile) with a rising trend, but this is predictive rather than confirmation of in-the-wild exploitation. The CVE is not in CISA KEV.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS93rd

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

6.1% chance of exploitation activity in the next 30 days, which ranks it in the 93rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band changemoderate → lowepss band change
2026-09-21EPSS band changelow → moderateepss band change
2026-09-06EPSS band changemoderate → lowepss band change
2026-09-05EPSS band changelow → moderateepss band change
2026-08-31EPSS band changemoderate → 0epss band change
2026-08-29EPSS band changelow → moderate

Affected products

sensiolabsoss-project
- symfonyLibraryLibraryOSS Libraries / generic-library

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Scored 6.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact