NetSight
IP …
high7.1

CVE-2019-10912

Deserialization of untrusted data in Symfony

Impact

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

Affected packages

EcosystemPackageAffectedFixed in
composersymfony/cache>= 3.1.0, < 3.4.263.4.26
composersymfony/phpunit-bridge>= 2.8.0, < 2.8.502.8.50
composersymfony/symfony>= 2.8.0, < 2.8.502.8.50
composertypo3/cms-core>= 9.0.0, < 9.5.89.5.8
composertypo3/cms>= 9.0.0, < 9.5.89.5.8

Affected products

VendorProductAffected versions
SensiolabsSymfony
from 2.8.0 before 2.8.50
from 3.4.0 before 3.4.26
from 4.1.0 before 4.1.12
from 4.2.0 before 4.2.7

Weakness classification

CWE-502

References