Security readout for executives and security teams
Plain-English summary
This CVE describes a cross-site scripting risk in Bolt 3.7.0 when Symfony Web Profiler is enabled. Search input may appear unsanitized on a profiler page. The issue is disputed because the profiler was not intended for production use, so business urgency depends on whether debug/profiler tooling is exposed.
Executive priority
Treat this as a configuration-sensitive exposure review, not an emergency, unless profiler routes are publicly reachable. Prioritize confirming production debug tooling is disabled and documenting any exposed Bolt 3.7.0 instances.
Technical view
Bolt 3.7.0 can reflect unsanitized search?search= input into the Symfony _profiler page when the profiler is used. The record relates it to CVE-2018-12040. No CVSS, CWE, patch, or confirmed affected CPE data is provided in the bundle.
Likely exposure
Exposure is likely limited to Bolt 3.7.0 deployments where Symfony Web Profiler is enabled and reachable by untrusted users. Production systems with profiler/debug routes disabled or access-controlled are less likely to be affected.
Exploitation context
The supplied sources do not show active exploitation, and the CVE is not in KEV. The issue requires the profiler page to process or display a crafted search value, but source evidence is too limited to assess exploit maturity.
Researcher notes
The public record is sparse and disputed. The key condition is Bolt 3.7.0 plus Symfony Web Profiler use. Avoid broad product conclusions beyond that. No source in the bundle names a patch, CVSS score, CWE, or active exploitation.
Mitigation direction
- Disable Symfony Web Profiler and debug tooling in production.
- Restrict access to _profiler routes to trusted administrators only.
- Check Bolt and Symfony guidance for supported upgrade or configuration recommendations.
- Review production configuration for accidental dev-mode or profiler exposure.
Validation and detection
- Inventory any public or internal Bolt 3.7.0 deployments.
- Confirm Symfony Web Profiler is disabled on production systems.
- Verify _profiler routes are not internet-accessible.
- Review configuration for debug, profiler, and environment-mode settings.
- Check logs for unexpected access to profiler pages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-20058 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/bolt/bolt/issues/7830CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.