Information Exposure Affecting symfony/symfony package, versions >=2.7.38, <2.7.50 >=2.8.0, <2.8.49 >=3.0.0, <3.4.20 >=4.0.0, <4.0.15 >=4.1.0, <4.1.9 >=4.2.0, <4.2.1
Threat Intelligence
EPSS
1.05% (85th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SYMFONYSYMFONY-72657
- published 10 Dec 2018
- disclosed 7 Dec 2018
- credit David Gorges
Introduced: 7 Dec 2018
CVE-2018-19789 Open this link in a new tabHow to fix?
Upgrade symfony/symfony to versions 2.7.50, 2.8.49, 3.4.20, 4.0.15, 4.1.9 4.2.1 or higher.
Overview
symfony/symfony is a The Symfony PHP framework.
Affected versions of this package are vulnerable to Information Exposure. When using the scalar type hint string in a setter method of a class that’s the data_class of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then the UploadedFile::__toString() function is called which will then return and disclose the path of the uploaded file.
References
CVSS Scores
version 3.1