CVE-2019-10910
Debian Security Advisory 4441-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
En Symfony antes de 2.7.51, 2.8.x antes de 2.8.50, 3.x antes de 3.4.26, 4.x antes de 4.1.12 y 4.2.x antes de 4.2.7, cuando los identificadores de servicio permiten la entrada del usuario, esto podría permitir una inyección SQL y ejecución remota de código. Esto está relacionado con Symfony / dependency-inyection.
Multiple vulnerabilities were discovered in the Symfony PHP framework which could lead to cache bypass, authentication bypass, information disclosure, open redirect, cross-site request forgery, deletion of arbitrary files, or arbitrary code execution.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-04-07 CVE Reserved
- 2019-05-10 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://www.synology.com/security/advisory/Synology_SA_19_19 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b | 2021-09-29 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sensiolabs Search vendor "Sensiolabs" | Symfony Search vendor "Sensiolabs" for product "Symfony" | >= 2.7.0 < 2.7.51 Search vendor "Sensiolabs" for product "Symfony" and version " >= 2.7.0 < 2.7.51" | - |
Affected
| ||||||
| Sensiolabs Search vendor "Sensiolabs" | Symfony Search vendor "Sensiolabs" for product "Symfony" | >= 2.8.0 < 2.8.50 Search vendor "Sensiolabs" for product "Symfony" and version " >= 2.8.0 < 2.8.50" | - |
Affected
| ||||||
| Sensiolabs Search vendor "Sensiolabs" | Symfony Search vendor "Sensiolabs" for product "Symfony" | >= 3.4.0 < 3.4.26 Search vendor "Sensiolabs" for product "Symfony" and version " >= 3.4.0 < 3.4.26" | - |
Affected
| ||||||
| Sensiolabs Search vendor "Sensiolabs" | Symfony Search vendor "Sensiolabs" for product "Symfony" | >= 4.1.0 < 4.1.12 Search vendor "Sensiolabs" for product "Symfony" and version " >= 4.1.0 < 4.1.12" | - |
Affected
| ||||||
| Sensiolabs Search vendor "Sensiolabs" | Symfony Search vendor "Sensiolabs" for product "Symfony" | >= 4.2.0 < 4.2.7 Search vendor "Sensiolabs" for product "Symfony" and version " >= 4.2.0 < 4.2.7" | - |
Affected
| ||||||
| Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | >= 8.5.0 < 8.5.15 Search vendor "Drupal" for product "Drupal" and version " >= 8.5.0 < 8.5.15" | - |
Affected
| ||||||
| Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | >= 8.6.0 < 8.6.15 Search vendor "Drupal" for product "Drupal" and version " >= 8.6.0 < 8.6.15" | - |
Affected
| ||||||