CVE-2019-10912

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input

published May 16, 2019

CVSS
—
EPSS
2%
Percentile
82.8
In the wild
Unconfirmed
What it is

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02260 · 82.8th percentile
Published
2019-05-16T21:20Z
EPSS history
Timeline
  • 16 MAY 21:20Z
    In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input
    cvelistv5