CVEvulnerability
CVE-2019-10910
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-05-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Affected configurations
• sensiolabs symfony (>= 2.7.0 < 2.7.51)
• sensiolabs symfony (>= 2.8.0 < 2.8.50)
• sensiolabs symfony (>= 3.4.0 < 3.4.26)
• sensiolabs symfony (>= 4.1.0 < 4.1.12)
• sensiolabs symfony (>= 4.2.0 < 4.2.7)
• drupal drupal (>= 8.5.0 < 8.5.15)
• drupal drupal (>= 8.6.0 < 8.6.15)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b Patch
- https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid Exploit, Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_19_19 Third Party Advisory
- https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b Patch
- https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid Exploit, Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_19_19 Third Party Advisory