Symfony XML decoding attack vector through external entities

2024-05-3000:52:20

Google

osv.dev

symfony

xmlencoder

external entities

xml parsing

security vulnerability

file inclusion

7.2 High

AI Score

Confidence

High

JSON

The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. In the Symfony2 framework the XML class may be used to deserialize objects or as part of a client/server API. By using external entities it is possible to include arbitrary files from the file system.

CPENameOperatorVersion
symfony/serializereq2.0.4
symfony/serializereq2.0.10
symfony/serializereq2.0.9
symfony/serializereq2.0.7
symfony/serializereq2.0.5
symfony/serializereq2.0.6

Name	Operator	Version
symfony/serializer	eq	2.0.4
symfony/serializer	eq	2.0.10
symfony/serializer	eq	2.0.9
symfony/serializer	eq	2.0.7
symfony/serializer	eq	2.0.5
symfony/serializer	eq	2.0.6

References

github.com/FriendsOfPHP/security-advisories/blob/master/symfony/serializer/2012-02-24.yaml

github.com/symfony/serializer

github.com/symfony/serializer/commit/0943a06a663b573d7319fc1acd56d3484eaaa430

symfony.com/blog/security-release-symfony-2-0-11-released

7.2 High

AI Score

Confidence

High

JSON