File Upload Vulnerability in Symfony Framework
CVE-2018-19789
5.3MEDIUM
Summary
A file upload vulnerability exists in the Symfony Framework, where inappropriate handling of uploaded files can lead to the disclosure of their full path. This issue arises when a setter method using the scalar type hint 'string' is employed in a form data class. If a file is submitted instead of the expected text input, the UploadedFile::__toString() method can expose sensitive information, subsequently opening the door to potential remote code execution when combined with a local file inclusion vulnerability.
References
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved