{"id":"GHSA-w4rc-rx25-8m86","aliases":["CVE-2019-11325"],"title":"Improper Input Validation in Symfony","description":"An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.","severity":"critical","score":9.8,"published":"2020-02-12T18:44:16.000Z","modified":"2023-11-08T04:01:01.031Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"symfony/symfony","ranges":[{"events":[{"introduced":"4.2.0"},{"fixed":"4.2.12"}],"type":"ECOSYSTEM"}],"versions":["v4.2.0","v4.2.1","v4.2.10","v4.2.11","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9"],"fixed":["4.2.12"]},{"ecosystem":"Packagist","name":"symfony/symfony","ranges":[{"events":[{"introduced":"4.3.0"},{"fixed":"4.3.8"}],"type":"ECOSYSTEM"}],"versions":["v4.3.0","v4.3.1","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7"],"fixed":["4.3.8"]},{"ecosystem":"Packagist","name":"symfony/var-exporter","ranges":[{"events":[{"introduced":"4.2.0"},{"fixed":"4.2.12"}],"type":"ECOSYSTEM"}],"versions":["v4.2.0","v4.2.1","v4.2.10","v4.2.11","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9"],"fixed":["4.2.12"]},{"ecosystem":"Packagist","name":"symfony/var-exporter","ranges":[{"events":[{"introduced":"4.3.0"},{"fixed":"4.3.8"}],"type":"ECOSYSTEM"}],"versions":["v4.3.0","v4.3.1","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7"],"fixed":["4.3.8"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2019-11325","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-11325.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/var-exporter/CVE-2019-11325.yaml","https://github.com/symfony/symfony/releases/tag/v4.3.8","https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3","https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter","https://symfony.com/blog/symfony-4-3-8-released","https://symfony.com/cve-2019-11325"],"sources":[{"name":"OSV","id":"GHSA-w4rc-rx25-8m86","modified":"2023-11-08T04:01:01.031973Z","url":"https://osv.dev/vulnerability/GHSA-w4rc-rx25-8m86"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}]}