CVE-2019-10910
CRITICAL 9.8
En bref
- Source
- NVD
- EPSS
- EPSS 6.02 % · centile 93 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Faiblesses (CWE)
- CWE-89 — Injection SQL
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-pgwj-prpq-jpc2 — Symfony Service IDs Allow Injection
Références européennes
- ENISA EUVD · EUVD-2019-0759
- GCVE · GCVE-0-2019-10910
Avis du CERT-FR
- CERTFR-2019-AVI-180 — Multiples vulnérabilités dans Drupal · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 2.7.0 < 2.7.51cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 2.8.0 < 2.8.50cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.26cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.12cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.7cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.5.0 < 8.5.15cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.6.0 < 8.6.15
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |