GHSA-q8j7-fjh7-25v5
Suggest an improvement- Source
- https://github.com/advisories/GHSA-q8j7-fjh7-25v5
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-q8j7-fjh7-25v5/GHSA-q8j7-fjh7-25v5.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-q8j7-fjh7-25v5
- Aliases
-
- CVE-2013-4751
- Published
- 2022-05-05T00:28:58Z
- Modified
- 2024-02-07T19:00:52.356398Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
- Details
-
When using the Validator component, if
Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCacheis enabled (or any other cache implementingSymfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface), some information is lost during serialization (thecollectionCascadedand thecollectionCascadedDeeplyfields).As a consequence, arrays or traversable objects stored in fields using the
@Validconstraint are not traversed by the validator as soon as the validator configuration is loaded from the cache. - Database specific
{ "cwe_ids": [ "CWE-20" ], "github_reviewed_at": "2023-08-17T22:38:30Z", "github_reviewed": true, "nvd_published_at": "2019-11-01T13:15:00Z", "severity": "HIGH" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2013-4751
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4751
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86364
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-4751.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/validator/CVE-2013-4751.yaml
- https://github.com/symfony/validator
- https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released
- https://web.archive.org/web/20200228181137/http://www.securityfocus.com/bid/61709
- http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114380.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114436.html
- http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released
Affected packages
Packagist
symfony/validator
symfony/validator
symfony/validator
Package
- Name
- symfony/validator
- Purl
- pkg:composer/symfony/validator
symfony/validator
Package
- Name
- symfony/validator
- Purl
- pkg:composer/symfony/validator
symfony/symfony
symfony/symfony
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony/symfony
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony/symfony