GitHub Advisoryadvisory · Packagist

GHSA-pgwj-prpq-jpc2 Symfony Service IDs Allow Injection

CRITICAL Published 2019-11-18 Modified 2025-05-29 Official page ↗
Aliases
CVE-2019-10910
Ecosystem
Packagist
Packages
symfony/dependency-injection, symfony/proxy-manager-bridge, symfony/symfony
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2019-11-18

Affected packages

• Packagist symfony/dependency-injection: >= 2.7.0, < 2.7.51 → fixed in 2.7.51 • Packagist symfony/dependency-injection: >= 2.8.0, < 2.8.50 → fixed in 2.8.50 • Packagist symfony/dependency-injection: >= 3.0.0, < 3.4.26 → fixed in 3.4.26 • Packagist symfony/dependency-injection: >= 4.0.0, < 4.1.12 → fixed in 4.1.12 • Packagist symfony/dependency-injection: >= 4.2.0, < 4.2.7 → fixed in 4.2.7 • Packagist symfony/proxy-manager-bridge: >= 2.7.0, < 2.7.51 → fixed in 2.7.51 • Packagist symfony/proxy-manager-bridge: >= 2.8.0, < 2.8.50 → fixed in 2.8.50 • Packagist symfony/proxy-manager-bridge: >= 3.0.0, < 3.4.26 → fixed in 3.4.26 • Packagist symfony/proxy-manager-bridge: >= 4.0.0, < 4.1.12 → fixed in 4.1.12 • Packagist symfony/proxy-manager-bridge: >= 4.2.0, < 4.2.7 → fixed in 4.2.7 • Packagist symfony/symfony: >= 2.7.0, < 2.7.51 → fixed in 2.7.51 • Packagist symfony/symfony: >= 2.8.0, < 2.8.50 → fixed in 2.8.50 • Packagist symfony/symfony: >= 3.0.0, < 3.4.26 → fixed in 3.4.26 • Packagist symfony/symfony: >= 4.0.0, < 4.1.12 → fixed in 4.1.12 • Packagist symfony/symfony: >= 4.2.0, < 4.2.7 → fixed in 4.2.7

Description

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.

Related

Alias · CVE (1)

  • CVE-2019-10910 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References