Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/40525?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40525?format=api", "vulnerability_id": "VCID-frbz-vpfe-vbh9", "summary": "Unrestricted Upload of File with Dangerous Type\nWhen using the scalar type hint `string` in a setter method (e.g. `setName(string$name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.", "aliases": [ { "alias": "CVE-2018-19789" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57153?format=api", "purl": "pkg:composer/symfony/form@2.7.50", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@2.7.50" }, { "url": "http://public2.vulnerablecode.io/api/packages/57154?format=api", "purl": "pkg:composer/symfony/form@2.8.49", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@2.8.49" }, { "url": "http://public2.vulnerablecode.io/api/packages/57155?format=api", "purl": "pkg:composer/symfony/form@3.4.20", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@3.4.20" }, { "url": "http://public2.vulnerablecode.io/api/packages/57156?format=api", "purl": "pkg:composer/symfony/form@4.0.15", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.0.15" }, { "url": "http://public2.vulnerablecode.io/api/packages/57157?format=api", "purl": "pkg:composer/symfony/form@4.1.9", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.1.9" }, { "url": "http://public2.vulnerablecode.io/api/packages/57158?format=api", "purl": "pkg:composer/symfony/form@4.2.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.2.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/57134?format=api", "purl": "pkg:composer/symfony/symfony@2.7.50", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.50" }, { "url": "http://public2.vulnerablecode.io/api/packages/57135?format=api", "purl": "pkg:composer/symfony/symfony@2.8.49", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.49" }, { "url": "http://public2.vulnerablecode.io/api/packages/57136?format=api", "purl": "pkg:composer/symfony/symfony@3.4.20", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.20" }, { "url": "http://public2.vulnerablecode.io/api/packages/57137?format=api", "purl": "pkg:composer/symfony/symfony@4.0.15", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.15" }, { "url": "http://public2.vulnerablecode.io/api/packages/57138?format=api", "purl": "pkg:composer/symfony/symfony@4.1.9", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.1.9" }, { "url": "http://public2.vulnerablecode.io/api/packages/57139?format=api", "purl": "pkg:composer/symfony/symfony@4.2.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.2.1" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56307?format=api", "purl": "pkg:composer/symfony/form@2.7.38", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-frbz-vpfe-vbh9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@2.7.38" }, { "url": "http://public2.vulnerablecode.io/api/packages/57148?format=api", "purl": "pkg:composer/symfony/form@2.8.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-frbz-vpfe-vbh9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@2.8.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/57149?format=api", "purl": "pkg:composer/symfony/form@3.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-frbz-vpfe-vbh9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@3.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/57150?format=api", "purl": "pkg:composer/symfony/form@4.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-frbz-vpfe-vbh9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/57151?format=api", "purl": "pkg:composer/symfony/form@4.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-frbz-vpfe-vbh9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.1.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/57152?format=api", "purl": "pkg:composer/symfony/form@4.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-frbz-vpfe-vbh9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.2.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55847?format=api", "purl": "pkg:composer/symfony/symfony@2.7.38", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-frbz-vpfe-vbh9" }, { "vulnerability": "VCID-mew1-9shg-mugs" }, { "vulnerability": "VCID-tx26-92jc-rkff" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.38" }, { "url": "http://public2.vulnerablecode.io/api/packages/55855?format=api", "purl": "pkg:composer/symfony/symfony@2.8.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1y96-v19f-tkgg" }, { "vulnerability": "VCID-23hr-yznx-c3fb" }, { "vulnerability": "VCID-3qct-gbgt-kkbb" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-7m45-bvbn-4qd3" }, { "vulnerability": "VCID-frbz-vpfe-vbh9" }, { "vulnerability": "VCID-mew1-9shg-mugs" }, { "vulnerability": "VCID-tx26-92jc-rkff" }, { "vulnerability": "VCID-uuk9-e5qy-rfgf" }, { "vulnerability": "VCID-zeut-9wfp-q7et" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55827?format=api", "purl": "pkg:composer/symfony/symfony@3.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-23hr-yznx-c3fb" }, { "vulnerability": "VCID-3qct-gbgt-kkbb" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-7m45-bvbn-4qd3" }, { "vulnerability": "VCID-ef86-hqv4-6kaz" }, { "vulnerability": "VCID-frbz-vpfe-vbh9" }, { "vulnerability": "VCID-mew1-9shg-mugs" }, { "vulnerability": "VCID-nsuz-7sdv-abef" }, { "vulnerability": "VCID-qqd1-smb1-sbe8" }, { "vulnerability": "VCID-tx26-92jc-rkff" }, { "vulnerability": "VCID-uuk9-e5qy-rfgf" }, { "vulnerability": "VCID-vyug-krcw-jyef" }, { "vulnerability": "VCID-zeut-9wfp-q7et" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/55828?format=api", "purl": "pkg:composer/symfony/symfony@4.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1y96-v19f-tkgg" }, { "vulnerability": "VCID-23hr-yznx-c3fb" }, { "vulnerability": "VCID-6c6t-kmb3-2qcm" }, { "vulnerability": "VCID-7m45-bvbn-4qd3" }, { "vulnerability": "VCID-ef86-hqv4-6kaz" }, { "vulnerability": "VCID-frbz-vpfe-vbh9" }, { "vulnerability": "VCID-mew1-9shg-mugs" }, { "vulnerability": "VCID-nsuz-7sdv-abef" }, { "vulnerability": "VCID-qqd1-smb1-sbe8" }, { "vulnerability": "VCID-tx26-92jc-rkff" }, { "vulnerability": "VCID-uuk9-e5qy-rfgf" }, { "vulnerability": "VCID-vyug-krcw-jyef" }, { "vulnerability": "VCID-zeut-9wfp-q7et" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/56268?format=api", "purl": "pkg:composer/symfony/symfony@4.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1y96-v19f-tkgg" }, { "vulnerability": "VCID-frbz-vpfe-vbh9" }, { "vulnerability": "VCID-m9e2-rg83-d7eb" }, { "vulnerability": "VCID-mew1-9shg-mugs" }, { "vulnerability": "VCID-qqd1-smb1-sbe8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.1.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/57133?format=api", "purl": "pkg:composer/symfony/symfony@4.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-frbz-vpfe-vbh9" }, { "vulnerability": "VCID-mew1-9shg-mugs" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.2.0" } ], "references": [ { "reference_url": "https://symfony.com/cve-2018-19789", "reference_id": "CVE-2018-19789", "reference_type": "", "scores": [], "url": "https://symfony.com/cve-2018-19789" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 434, "name": "Unrestricted Upload of File with Dangerous Type", "description": "The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": null, "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-frbz-vpfe-vbh9" }