Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2012-5574

lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request.

Published

2012-12-18T01:55:06.447

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sensiolabs	symfony	≤ 1.4.19	Yes
Application	sensiolabs	symfony	1.4.0	Yes
Application	sensiolabs	symfony	1.4.0	Yes
Application	sensiolabs	symfony	1.4.0	Yes
Application	sensiolabs	symfony	1.4.1	Yes
Application	sensiolabs	symfony	1.4.2	Yes
Application	sensiolabs	symfony	1.4.3	Yes
Application	sensiolabs	symfony	1.4.4	Yes
Application	sensiolabs	symfony	1.4.5	Yes
Application	sensiolabs	symfony	1.4.6	Yes
Application	sensiolabs	symfony	1.4.7	Yes
Application	sensiolabs	symfony	1.4.8	Yes
Application	sensiolabs	symfony	1.4.9	Yes
Application	sensiolabs	symfony	1.4.10	Yes
Application	sensiolabs	symfony	1.4.11	Yes
Application	sensiolabs	symfony	1.4.12	Yes
Application	sensiolabs	symfony	1.4.13	Yes
Application	sensiolabs	symfony	1.4.14	Yes
Application	sensiolabs	symfony	1.4.15	Yes
Application	sensiolabs	symfony	1.4.16	Yes
Application	sensiolabs	symfony	1.4.17	Yes
Application	sensiolabs	symfony	1.4.18	Yes

References

http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093698.html ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093920.html ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093922.html ([email protected])
http://secunia.com/advisories/51372 Vendor Advisory ([email protected])
http://symfony.com/blog/security-release-symfony-1-4-20-released Patch, Vendor Advisory ([email protected])
http://trac.symfony-project.org/changeset/33598 Patch ([email protected])
http://www.openwall.com/lists/oss-security/2012/11/26/12 Patch ([email protected])
http://www.osvdb.org/87869 ([email protected])
http://www.securityfocus.com/bid/56685 ([email protected])
https://bugs.gentoo.org/show_bug.cgi?id=444696 Exploit ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=880240 ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/80309 ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093698.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093920.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093922.html (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/51372 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://symfony.com/blog/security-release-symfony-1-4-20-released Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://trac.symfony-project.org/changeset/33598 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2012/11/26/12 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.osvdb.org/87869 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/56685 (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.gentoo.org/show_bug.cgi?id=444696 Exploit (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=880240 (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/80309 (af854a3a-2127-422b-91ae-364da2661108)