Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:composer/symfony/form@4.1.0

Type composer

Namespace symfony

Name form

Version 4.1.0

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 4.1.9

Latest_non_vulnerable_version 6.2.6

Affected_by_vulnerabilities

url VCID-frbz-vpfe-vbh9

vulnerability_id VCID-frbz-vpfe-vbh9

summary

Unrestricted Upload of File with Dangerous Type
When using the scalar type hint `string` in a setter method (e.g. `setName(string$name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.

references

reference_url	https://symfony.com/cve-2018-19789
reference_id	CVE-2018-19789
reference_type
scores
url	https://symfony.com/cve-2018-19789

fixed_packages

url	pkg:composer/symfony/form@4.1.9
purl	pkg:composer/symfony/form@4.1.9
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.1.9

url	pkg:composer/symfony/form@4.2.1
purl	pkg:composer/symfony/form@4.2.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.2.1

aliases CVE-2018-19789

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-frbz-vpfe-vbh9

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/form@4.1.0

Package Instance