CVE-2013-1348

The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.

Published Bycve@mitre.org

Published DateJun 02, 2014, 15:55

Affected Versions(2)

symfony/symfony(Packagist)

Introduced2.0.0

Fixed2.0.22

LimitN/A

symfony/yaml(Packagist)

Introduced2.0.0

Fixed2.0.22

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
symfony/symfony(Packagist)	2.0.0	2.0.22	N/A
symfony/yaml(Packagist)	2.0.0	2.0.22	N/A

Weakness Type (CWE):CWE-94

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

Weakness Type (CWE):CWE-94

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL