7.1
CVE-2019-10912
- EPSS 1.16%
- Veröffentlicht 16.05.2019 22:29:00
- Zuletzt bearbeitet 21.11.2024 04:20:08
- Quelle cve@mitre.org
- Teams Watchlist Login
- Unerledigt Login
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sensiolabs ≫ Symfony Version >= 2.8.0 < 2.8.50
Sensiolabs ≫ Symfony Version >= 3.4.0 < 3.4.26
Sensiolabs ≫ Symfony Version >= 4.1.0 < 4.1.12
Sensiolabs ≫ Symfony Version >= 4.2.0 < 4.2.7
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.16% | 0.778 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.1 | 2.8 | 4.2 |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
|
| nvd@nist.gov | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
CWE-502 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.