Code Execution Vulnerability in Symfony VarExporter Component
CVE-2019-11325

9.8CRITICAL

Key Information:

Vendor
Sensiolabs
Status
Symfony
Vendor
CVE Published:
21 November 2019

Summary

A flaw in the Symfony VarExporter component affects versions prior to 4.2.12 and 4.3.x before 4.3.8. This issue arises from improper string escaping which may lead to the execution of arbitrary PHP code when specially crafted strings are processed. It poses a significant risk to applications relying on this component for variable exporting. Mitigation is available in subsequent updates, which address this critical vulnerability by enhancing string handling and safety.

References

https://github.com/symfony/var-exporter/compare/d8bf442.....
x_refsource_MISC
https://symfony.com/blog/symfony-4-3-8-released
x_refsource_CONFIRM
https://github.com/symfony/symfony/releases/tag/v4.3.8
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-11325 : Code Execution Vulnerability in Symfony VarExporter Component | SecurityVulnerability.io