CVE-2019-11325 — Improper Input Validation in symfony/symfony —...
Improper Input Validation in Symfony
Summary
Advisory Timeline
- First published February 12, 2020 (2434 days ago).
- Last revised November 8, 2023 — 1364 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
composer require "symfony/symfony:^4.2.12"
composer require "symfony/symfony:^4.3.8"
composer require "symfony/var-exporter:^4.3.8"
composer require "symfony/var-exporter:^4.2.12"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (4)
Affects 1 ecosystem: packagist (2).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| symfony/symfony | packagist | v4.2.0, v4.2.1, v4.2.10, v4.2.11 (+8 more) | 4.2.12 |
| symfony/symfony | packagist | v4.3.0, v4.3.1, v4.3.2, v4.3.3 (+4 more) | 4.3.8 |
| symfony/var-exporter | packagist | v4.3.0, v4.3.1, v4.3.2, v4.3.3 (+4 more) | 4.3.8 |
| symfony/var-exporter | packagist | v4.2.0, v4.2.1, v4.2.10, v4.2.11 (+8 more) | 4.2.12 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-116Improper Encoding or EscapingMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-11325ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-11325.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/var-exporter/CVE-2019-11325.yamlWEB
- https://github.com/symfony/symfony/releases/tag/v4.3.8WEB
- https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3WEB
- https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporterWEB
- https://symfony.com/blog/symfony-4-3-8-releasedWEB
- https://symfony.com/cve-2019-11325WEB
Frequently Asked Questions
- What is CVE-2019-11325?
- Improper Input Validation in Symfony This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2019-11325?
- CVE-2019-11325 affects symfony/symfony and symfony/var-exporter. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2019-11325 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2018-11407CRITICAL
Symfony Authentication Bypass
- CVE-2017-11365CRITICAL
Symfony Incorrect Access Control
- CVE-2016-2403CRITICAL
Symfony Authentication Bypass
- CVE-2019-10913CRITICAL
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
- CVE-2026-45063HIGH
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
- CVE-2024-51736HIGH
Symfony vulnerable to command execution hijack on Windows with Process class
- CVE-2014-6072HIGH
Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
- CVE-2026-45068MEDIUM
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies