Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2019-10910

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.

VectorNETWORK

PublishedMay 16, 2019, 22:29

Published Bycve@mitre.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

symfony/dependency-injection(Packagist)2.7.02.7.51N/A

symfony/dependency-injection(Packagist)2.8.02.8.50N/A

symfony/dependency-injection(Packagist)3.0.03.4.26N/A

symfony/dependency-injection(Packagist)4.0.04.1.12N/A

symfony/dependency-injection(Packagist)4.2.04.2.7N/A

symfony/proxy-manager-bridge(Packagist)2.7.02.7.51N/A

symfony/proxy-manager-bridge(Packagist)2.8.02.8.50N/A

symfony/proxy-manager-bridge(Packagist)3.0.03.4.26N/A

symfony/proxy-manager-bridge(Packagist)4.0.04.1.12N/A

symfony/proxy-manager-bridge(Packagist)4.2.04.2.7N/A

symfony/symfony(Packagist)2.7.02.7.51N/A

symfony/symfony(Packagist)2.8.02.8.50N/A

symfony/symfony(Packagist)3.0.03.4.26N/A

symfony/symfony(Packagist)4.0.04.1.12N/A

symfony/symfony(Packagist)4.2.04.2.7N/A

References

Weakness Type

CWE-89

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK