CRITICAL🇬🇧 English

CVE-2019-10913

CVSS 9.8v3.0pub. 2019-05-16upd. 2024-11-21

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.

oryginał EN
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sensiolabs Symfony

    APP
    Sensiolabs
    2.7.0 – 2.7.51 (bez)2.8.0 – 2.8.50 (bez)3.4.0 – 3.4.26 (bez)4.1.0 – 4.1.12 (bez)4.2.0 – 4.2.7 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
SQLiXSS
CWE
Referencje

Powiązane podatności

CVE-2019-11325CRITICAL9.8ten sam produkt

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly e...

CVE-2019-18889CRITICAL9.8ten sam produkt

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serial...

CVE-2017-11365CRITICAL9.8ten sam produkt

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2....

CVE-2019-10910CRITICAL9.8ten sam produkt

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, w...

CVE-2018-11407CRITICAL9.8ten sam produkt

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x befor...