CVE-2019-10912

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

• CVE ID
• CVE-2019-10912

• Assigner
• cve@mitre.org

• Vulnerability Status
• Modified

• Published Version
• 2019-05-16T22:29:00

• Last Modified Date
• 2019-07-12T14:15:11

• Version
• 2.0

• Vector String
• AV:N/AC:L/Au:S/C:P/I:P/A:P

• Access Vector
• NETWORK

• Access Compatibility
• LOW

• Authentication
• SINGLE

• Confidentiality Impact
• PARTIAL

• Integrity Impact
• PARTIAL

• Availability Impact
• PARTIAL

• Base Score
• 6.5

• Severity
• MEDIUM

• Exploitability Score
• 8

• Impact Score
• 6.4

• Version
• 3.0

• Vector String
• CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

• Attack Vector
• NETWORK

• Attack Compatibility
• LOW

• Privileges Required
• LOW

• User Interaction
• NONE

• Scope
• UNCHANGED

• Confidentiality Impact
• LOW

• Availability Impact
• NONE

• Base Score
• 7.1

• Base Severity
• HIGH

• Exploitability Score
• 2.8

• Impact Score
• 4.2