Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/symfony/form@4.0.0
Typecomposer
Namespacesymfony
Nameform
Version4.0.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.0.15
Latest_non_vulnerable_version6.2.6
Affected_by_vulnerabilities
0
url VCID-frbz-vpfe-vbh9
vulnerability_id VCID-frbz-vpfe-vbh9
summary 
Unrestricted Upload of File with Dangerous Type
When using the scalar type hint `string` in a setter method (e.g. `setName(string$name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.
references
0
reference_url https://symfony.com/cve-2018-19789
reference_id CVE-2018-19789
reference_type
scores
url https://symfony.com/cve-2018-19789
fixed_packages
0
url pkg:composer/symfony/form@4.0.15
purl pkg:composer/symfony/form@4.0.15
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.0.15
1
url pkg:composer/symfony/form@4.1.9
purl pkg:composer/symfony/form@4.1.9
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.1.9
2
url pkg:composer/symfony/form@4.2.1
purl pkg:composer/symfony/form@4.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.2.1
aliases CVE-2018-19789
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-frbz-vpfe-vbh9
1
url VCID-p6f7-utd6-eqej
vulnerability_id VCID-p6f7-utd6-eqej
summary 
Information Exposure
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that status codes are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist.
references
0
reference_url https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011
reference_id
reference_type
scores
url https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-21424
reference_id CVE-2021-21424
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2021-21424
2
reference_url https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68
reference_id GHSA-5pv8-ppvj-4h68
reference_type
scores
url https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68
fixed_packages
0
url pkg:composer/symfony/form@4.4.24
purl pkg:composer/symfony/form@4.4.24
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.4.24
1
url pkg:composer/symfony/form@5.2.8
purl pkg:composer/symfony/form@5.2.8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@5.2.8
aliases CVE-2021-21424, GHSA-5pv8-ppvj-4h68
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p6f7-utd6-eqej
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.0.0