CVE-2018-19789: An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before…

PriorityP433medium5.3CVSS 3.0

AVNACLPRNUINSUCLINAN

EPSS

3.59%

88.1th percentile

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	symfony	< symfony 3.4.20+dfsg-1 (bookworm)	symfony 3.4.20+dfsg-1 (bookworm)
sensiolabs	symfony	>= 2.7.0 < 2.7.50	2.7.50
sensiolabs	symfony	>= 2.8.0 < 2.8.49	2.8.49
sensiolabs	symfony	>= 3.0.0 < 3.4.20	3.4.20
sensiolabs	symfony	>= 4.0.0 < 4.0.15	4.0.15
sensiolabs	symfony	>= 4.1.0 < 4.1.9	4.1.9
sensiolabs	symfony	>= 4.2.0 < 4.2.1	4.2.1
symfony	form	>= 2.7.0 < 2.7.50	2.7.50
symfony	form	>= 2.8.0 < 2.8.49	2.8.49
symfony	form	>= 3.0.0 < 3.4.20	3.4.20
symfony	form	>= 4.0.0 < 4.0.15	4.0.15
symfony	form	>= 4.1.0 < 4.1.9	4.1.9
symfony	form	>= 4.2.0 < 4.2.1	4.2.1
symfony	symfony	>= 0 < 3.4.20+dfsg-1	3.4.20+dfsg-1
symfony	symfony	>= 0 < 3.4.20+dfsg-1	3.4.20+dfsg-1
symfony	symfony	>= 0 < 3.4.20+dfsg-1	3.4.20+dfsg-1
symfony	symfony	>= 0 < 3.4.20+dfsg-1	3.4.20+dfsg-1
symfony	symfony	>= 2.7.0 < 2.7.50	2.7.50
symfony	symfony	>= 2.8.0 < 2.8.49	2.8.49
symfony	symfony	>= 3.0.0 < 3.4.20	3.4.20
symfony	symfony	>= 4.0.0 < 4.0.15	4.0.15
symfony	symfony	>= 4.1.0 < 4.1.9	4.1.9
symfony	symfony	>= 4.2.0 < 4.2.1	4.2.1

CVSS provenance

nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

osv5.3MEDIUM

vendor_debian5.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.