CRITICAL🇵🇱 Wersja polska

CVE-2019-10913

CVSS 9.8v3.0pub. 2019-05-16upd. 2024-11-21

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sensiolabs Symfony

    APP
    Sensiolabs
    2.7.0 – 2.7.51 (bez)2.8.0 – 2.8.50 (bez)3.4.0 – 3.4.26 (bez)4.1.0 – 4.1.12 (bez)4.2.0 – 4.2.7 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLiXSS
CWE
References

Related vulnerabilities

CVE-2019-11325CRITICAL9.8ten sam produkt

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly e...

CVE-2019-18889CRITICAL9.8ten sam produkt

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serial...

CVE-2017-11365CRITICAL9.8ten sam produkt

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2....

CVE-2019-10910CRITICAL9.8ten sam produkt

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, w...

CVE-2018-11407CRITICAL9.8ten sam produkt

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x befor...