Symfony Service IDs Allow Injection
Critical severity
GitHub Reviewed
Published
Nov 18, 2019
to the GitHub Advisory Database
•
Updated Sep 21, 2023
Package
Affected versions
>= 2.7.0, < 2.7.51
>= 2.8.0, < 2.8.50
>= 3.0.0, < 3.4.26
>= 4.0.0, < 4.1.12
>= 4.2.0, < 4.2.7
Patched versions
2.7.51
2.8.50
3.4.26
4.1.12
4.2.7
>= 2.7.0, < 2.7.51
>= 2.8.0, < 2.8.50
>= 3.0.0, < 3.4.26
>= 4.0.0, < 4.1.12
>= 4.2.0, < 4.2.7
2.7.51
2.8.50
3.4.26
4.1.12
4.2.7
>= 2.7.0, < 2.7.51
>= 2.8.0, < 2.8.50
>= 3.0.0, < 3.4.26
>= 4.0.0, < 4.1.12
>= 4.2.0, < 4.2.7
2.7.51
2.8.50
3.4.26
4.1.12
4.2.7
Description
Published by the National Vulnerability Database
May 16, 2019
Reviewed
Nov 18, 2019
Published to the GitHub Advisory Database
Nov 18, 2019
Last updated
Sep 21, 2023
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
References