Remote Code Execution (RCE)

🗓️ 18 Apr 2019 02:43:58Reported by Veracode Vulnerability DatabaseType

Symfony software vulnerability remote code executio

Reporter	Title	Published	Views	Family All 65
FreeBSD	drupal -- Drupal core - Moderately critical	17 Apr 201900:00	–	freebsd
BDU FSTEC	The vulnerability of the “symfony/dependency-injection” service identifier on the Symfony software platform for web application development and management arises from the lack of protective measures for SQL query structures. This allows attackers to execute arbitrary code through SQL injection attacks.	1 Oct 201900:00	–	bdu_fstec
Circl	CVE-2019-10910	16 May 201922:51	–	circl
CNVD	Drupal Code Execution Vulnerability (CNVD-2019-13248)	22 Apr 201900:00	–	cnvd
CVE	CVE-2019-10910	16 May 201921:31	–	cve
Cvelist	CVE-2019-10910	16 May 201921:31	–	cvelist
Debian	[SECURITY] [DLA 1778-1] symfony security update	6 May 201919:15	–	debian
Debian	[SECURITY] [DSA 4441-1] symfony security update	10 May 201906:26	–	debian
Debian	[SECURITY] [DSA 4441-1] symfony security update	10 May 201906:26	–	debian
Debian CVE	CVE-2019-10910	16 May 201921:31	–	debiancve

Vulners

Node

sensiolabs symfony/symfonyRange4.2.0-BETA1–4.2.6php

sensiolabs symfony/symfonyRange3.4.0-BETA1–3.4.25php

sensiolabs symfony/symfonyRange4.1.0-BETA1–4.1.11php

sensiolabs symfony/symfonyRange2.8.0-BETA1–2.8.49php

sensiolabs symfony/symfonyRange2.0.0BETA1–2.7.50php

sensiolabs symfony/symfonyRange3.0.0-BETA1–3.3.18php

sensiolabs symfony/symfonyRange4.0.0-BETA1–4.0.15php

Source	Link
github	www.github.com/symfony/symfony/pull/31145
symfony	www.symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
github	www.github.com/symfony/symfony/pull/31147
github	www.github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
synology	www.synology.com/security/advisory/Synology_SA_19_19
symfony	www.symfony.com/blog/symfony-3-4-26-released

09 Nov 2019 17:02Current

8.7High risk

Vulners AI Score8.7

CVSS 27.5

CVSS 3.19.8

EPSS0.11901