CVEvulnerability
CVE-2012-5574
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-12-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request.
Affected configurations
• sensiolabs symfony (<= 1.4.19)
• sensiolabs symfony 1.4.0
• sensiolabs symfony 1.4.1
• sensiolabs symfony 1.4.2
• sensiolabs symfony 1.4.3
• sensiolabs symfony 1.4.4
• sensiolabs symfony 1.4.5
• sensiolabs symfony 1.4.6
• sensiolabs symfony 1.4.7
• sensiolabs symfony 1.4.8
• sensiolabs symfony 1.4.9
• sensiolabs symfony 1.4.10
• sensiolabs symfony 1.4.11
• sensiolabs symfony 1.4.12
• sensiolabs symfony 1.4.13
• sensiolabs symfony 1.4.14
• sensiolabs symfony 1.4.15
• sensiolabs symfony 1.4.16
• sensiolabs symfony 1.4.17
• sensiolabs symfony 1.4.18
Related
Weakness · not in database (1)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093698.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093920.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093922.html lists.fedoraproject.org
- http://secunia.com/advisories/51372 Vendor Advisory
- http://symfony.com/blog/security-release-symfony-1-4-20-released Patch, Vendor Advisory
- http://trac.symfony-project.org/changeset/33598 Patch
- http://www.openwall.com/lists/oss-security/2012/11/26/12 Patch
- http://www.osvdb.org/87869 www.osvdb.org
- http://www.securityfocus.com/bid/56685 www.securityfocus.com
- https://bugs.gentoo.org/show_bug.cgi?id=444696 Exploit
- https://bugzilla.redhat.com/show_bug.cgi?id=880240 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80309 exchange.xforce.ibmcloud.com
- http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093698.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093920.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093922.html lists.fedoraproject.org
- http://secunia.com/advisories/51372 Vendor Advisory
- http://symfony.com/blog/security-release-symfony-1-4-20-released Patch, Vendor Advisory
- http://trac.symfony-project.org/changeset/33598 Patch
- http://www.openwall.com/lists/oss-security/2012/11/26/12 Patch
- http://www.osvdb.org/87869 www.osvdb.org
- http://www.securityfocus.com/bid/56685 www.securityfocus.com
- https://bugs.gentoo.org/show_bug.cgi?id=444696 Exploit
- https://bugzilla.redhat.com/show_bug.cgi?id=880240 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80309 exchange.xforce.ibmcloud.com