GHSA-w2fr-65vp-mxw3HighCVSS 7.1

Deserialization of untrusted data in Symfony

Published
February 12, 2020
Last Modified
February 5, 2024

🔗 CVE IDs covered (1)

CVE-2019-10912 →

📋 Description

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

🎯 Affected products13

  • composer/symfony/cache:>= 3.1.0, < 3.4.26
  • composer/symfony/cache:>= 4.0.0, < 4.1.12
  • composer/symfony/cache:>= 4.2.0, < 4.2.7
  • composer/symfony/phpunit-bridge:>= 2.8.0, < 2.8.50
  • composer/symfony/phpunit-bridge:>= 3.0.0, < 3.4.26
  • composer/symfony/phpunit-bridge:>= 4.0.0, < 4.1.12
  • composer/symfony/phpunit-bridge:>= 4.2.0, < 4.2.7
  • composer/symfony/symfony:>= 2.8.0, < 2.8.50
  • composer/symfony/symfony:>= 3.0.0, < 3.4.26
  • composer/symfony/symfony:>= 4.0.0, < 4.1.12
  • composer/symfony/symfony:>= 4.2.0, < 4.2.7
  • composer/typo3/cms-core:>= 9.0.0, < 9.5.8
  • composer/typo3/cms:>= 9.0.0, < 9.5.8

🔗 References (30)