CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2019-11325

CVSS 9.8v3.1pub. 2019-11-21upd. 2024-11-21

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sensiolabs Symfony

    APP
    Sensiolabs
    4.2.0 – 4.2.12 (bez)4.3.0 – 4.3.8 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2019-18889CRITICAL9.8ten sam produkt

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serial...

CVE-2017-11365CRITICAL9.8ten sam produkt

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2....

CVE-2019-10913CRITICAL9.8ten sam produkt

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, H...

CVE-2019-10910CRITICAL9.8ten sam produkt

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, w...

CVE-2018-11407CRITICAL9.8ten sam produkt

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x befor...