Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-18888

An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).

Published

2019-11-21T23:15:13.530

Last Modified

2024-11-21T04:33:47.133

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-88
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sensiolabs symfony ≤ 2.8.50 Yes
Application sensiolabs symfony ≤ 3.4.34 Yes
Application sensiolabs symfony ≤ 4.2.11 Yes
Application sensiolabs symfony ≤ 4.3.7 Yes
Operating System fedoraproject fedora 30 Yes
Operating System fedoraproject fedora 31 Yes
References