Symfony Path Disclosure

2022-05-1401:04:20

Google

osv.dev

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.026 Low

EPSS

Percentile

90.2%

JSON

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint string in a setter method (e.g. setName(string $name)) of a class that’s the data_class of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then UploadedFile::__toString() is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.

CPENameOperatorVersion
symfony/symfonyeq3.0.6
symfony/symfonyeq3.1.7
symfony/symfonyeq3.4.8
symfony/formeq2.7.27
symfony/formeq4.0.9
symfony/symfonyeq2.8.47
symfony/symfonyeq2.7.3
symfony/formeq3.4.11
symfony/symfonyeq3.2.11
symfony/formeq2.8.40

Name	Operator	Version
symfony/symfony	eq	3.0.6
symfony/symfony	eq	3.1.7
symfony/symfony	eq	3.4.8
symfony/form	eq	2.7.27
symfony/form	eq	4.0.9
symfony/symfony	eq	2.8.47
symfony/symfony	eq	2.7.3
symfony/form	eq	3.4.11
symfony/symfony	eq	3.2.11
symfony/form	eq	2.8.40