CVE-2013-4751
published 2019-11-01CVE-2013-4751: php-symfony2-Validator has loss of information during serialization
PriorityP341high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
1.44%
70.4th percentile
php-symfony2-Validator has loss of information during serialization
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | enterprise_linux | — | — |
| sensiolabs | symfony | >= 2.0.0 < 2.0.24 | 2.0.24 |
| sensiolabs | symfony | >= 2.1.0 < 2.1.12 | 2.1.12 |
| sensiolabs | symfony | >= 2.2.0 < 2.2.5 | 2.2.5 |
| sensiolabs | symfony | >= 2.3.0 < 2.3.3 | 2.3.3 |
| symfony | symfony | >= 2.0.0 < 2.0.24 | 2.0.24 |
| symfony | symfony | >= 2.1.0 < 2.1.12 | 2.1.12 |
| symfony | symfony | >= 2.2.0 < 2.2.5 | 2.2.5 |
| symfony | symfony | >= 2.3.0 < 2.3.3 | 2.3.3 |
| symfony | validator | >= 2.0.0 < 2.0.24 | 2.0.24 |
| symfony | validator | >= 2.1.0 < 2.1.12 | 2.1.12 |
| symfony | validator | >= 2.2.0 < 2.2.5 | 2.2.5 |
| symfony | validator | >= 2.3.0 < 2.3.3 | 2.3.3 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
osv·2022-05-05
CVE-2013-4751 [HIGH] Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
When using the Validator component, if `Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache` is enabled (or any other cache implementing `Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface`), some information is lost during serialization (the `collectionCascaded` and the `collectionCascadedDeeply` fields).
As a consequence, arrays or traversable objects stored in fields using the `@Valid` constraint are not traversed by the validator as soon as the validator configuration is loaded from the cache.
GHSA
Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
ghsa·2022-05-05
CVE-2013-4751 [HIGH] CWE-20 Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
When using the Validator component, if `Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache` is enabled (or any other cache implementing `Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface`), some information is lost during serialization (the `collectionCascaded` and the `collectionCascadedDeeply` fields).
As a consequence, arrays or traversable objects stored in fields using the `@Valid` constraint are not traversed by the validator as soon as the validator configuration is loaded from the cache.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-4751 php-symfony2-Validator: php-symfony2-Validation: validation metadata serialization and loss of information [epel-6]
bugzilla·2013-08-09·CVSS 8.1
CVE-2013-4751 [HIGH] CVE-2013-4751 php-symfony2-Validator: php-symfony2-Validation: validation metadata serialization and loss of information [epel-6]
CVE-2013-4751 php-symfony2-Validator: php-symfony2-Validation: validation metadata serialization and loss of information [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi
Bugzilla
CVE-2013-4751 php-symfony2-Validator: php-symfony2-Validation: validation metadata serialization and loss of information [fedora-all]
bugzilla·2013-08-09·CVSS 8.1
CVE-2013-4751 [HIGH] CVE-2013-4751 php-symfony2-Validator: php-symfony2-Validation: validation metadata serialization and loss of information [fedora-all]
CVE-2013-4751 php-symfony2-Validator: php-symfony2-Validation: validation metadata serialization and loss of information [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi
Bugzilla
CVE-2013-4751 php-symfony2-Validation: validation metadata serialization and loss of information
bugzilla·2013-08-09·CVSS 8.1
CVE-2013-4751 [HIGH] CVE-2013-4751 php-symfony2-Validation: validation metadata serialization and loss of information
CVE-2013-4751 php-symfony2-Validation: validation metadata serialization and loss of information
As noted from [1]:
CVE-2013-4751: Validation metadata serialization and loss of information:
Affected versions:
All 2.0.X, 2.1.X, 2.2.X, and 2.3.X versions of the Validator component are affected by this issue.
Description:
When using the Validator component, if Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache is enabled (or any other cache implementing Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface), some information is lost during serialization (the collectionCascaded and the collectionCascadedDeeply fields).
As a consequence, arrays or traversable objects stored in fields using the @Valid constraint are not traversed by the validator as soon as the validator conf
http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114380.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-August/114436.htmlhttp://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-releasedhttp://www.securityfocus.com/bid/61709https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4751https://exchange.xforce.ibmcloud.com/vulnerabilities/86364http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114380.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-August/114436.htmlhttp://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-releasedhttp://www.securityfocus.com/bid/61709https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4751https://exchange.xforce.ibmcloud.com/vulnerabilities/86364
2019-11-01
Published