CVE-2019-18888
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 2.25 % · percentile 83 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).
Weaknesses (CWE)
- CWE-88 — Improper Neutralization of Argument Delimiters in a Command
References
- https://symfony.com/blog/symfony-4-3-8-released
- https://github.com/symfony/symfony/releases/tag/v4.3.8
- https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-xhh6-956q-4q69 — Argument injection in a MimeTypeGuesser in Symfony
European references
- ENISA EUVD · EUVD-2019-0807
- GCVE · GCVE-0-2019-18888
Affected configurations (NVD CPE)
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 2.8.0 ≤ 2.8.50cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 3.4.0 ≤ 3.4.34cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 4.2.0 ≤ 4.2.11cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*≥ 4.3.0 ≤ 4.3.7cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |