Symfony Service IDs Allow Injection
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-10910US | critical9.8 | — | ||
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection a… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10910.yamlWEB
- https://github.com/symfony/symfonyPACKAGE
- https://github.com/symfony/symfony/commit/3876c75f858d5d82e2c309698d21af2f1d721afbWEB
- https://github.com/symfony/symfony/commit/4c80c3444854ef384df94deb4acbcef4b5e5243bWEB
- https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737bWEB
- https://nvd.nist.gov/vuln/detail/CVE-2019-10910ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan