Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-pgwj-prpq-jpc2
Advisory ID github_osv/GHSA-pgwj-prpq-jpc2
Aliases CVE-2019-10910
Summary Symfony Service IDs Allow Injection In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
System Score Found at
cvssv3 9.8 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/11/GHSA-pgwj-prpq-jpc2/GHSA-pgwj-prpq-jpc2.json
generic_textual CRITICAL
Reference id Reference type URL
https://github.com/symfony/symfony
https://github.com/symfony/symfony/commit/3876c75f858d5d82e2c309698d21af2f1d721afb
https://github.com/symfony/symfony/commit/4c80c3444854ef384df94deb4acbcef4b5e5243b
https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
https://www.synology.com/security/advisory/Synology_SA_19_19
CVE-2019-10910 https://nvd.nist.gov/vuln/detail/CVE-2019-10910
CVE-2019-10910 https://symfony.com/cve-2019-10910
CVE-2019-10910-CHECK-SERVICE-IDS-ARE-VALID https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
CVE-2019-10910.YAML https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yaml
CVE-2019-10910.YAML https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yaml
CVE-2019-10910.YAML https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10910.yaml
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/11/GHSA-pgwj-prpq-jpc2/GHSA-pgwj-prpq-jpc2.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.