CVE-2019-10912

HIGH7.1EPSS 1.1%

Deserialization of untrusted data in Symfony

發布日:2020/2/12修改日:2026/5/27
也稱為:GHSA-w2fr-65vp-mxw3DEBIAN-CVE-2019-10912

描述

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

受影響套件(6)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1HIGH7.1CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

參考連結(29)