CVEvulnerability
CVE-2019-11325
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-11-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-116
Description
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
Affected configurations
• sensiolabs symfony (>= 4.2.0 < 4.2.12)
• sensiolabs symfony (>= 4.3.0 < 4.3.8)
Related
Weakness · CWE (1)
- CWE-116 Improper Encoding or Escaping of Output weakness
References
- https://github.com/symfony/symfony/releases/tag/v4.3.8 Release Notes, Third Party Advisory
- https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3 Patch, Third Party Advisory
- https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter Vendor Advisory
- https://symfony.com/blog/symfony-4-3-8-released Release Notes, Vendor Advisory
- https://github.com/symfony/symfony/releases/tag/v4.3.8 Release Notes, Third Party Advisory
- https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3 Patch, Third Party Advisory
- https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter Vendor Advisory
- https://symfony.com/blog/symfony-4-3-8-released Release Notes, Vendor Advisory