CVE-2019-10910:
Symfony Service IDs Allow Injection
9.8
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.94874%
CWE
Published
11/18/2019
Updated
9/21/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/dependency-injection | composer | >= 2.7.0, < 2.7.51 | 2.7.51 |
| symfony/dependency-injection | composer | >= 2.8.0, < 2.8.50 | 2.8.50 |
| symfony/dependency-injection | composer | >= 3.0.0, < 3.4.26 | 3.4.26 |
| symfony/dependency-injection | composer | >= 4.0.0, < 4.1.12 | 4.1.12 |
| symfony/dependency-injection | composer | >= 4.2.0, < 4.2.7 | 4.2.7 |
| symfony/proxy-manager-bridge | composer | >= 2.7.0, < 2.7.51 | 2.7.51 |
| symfony/proxy-manager-bridge | composer | >= 2.8.0, < 2.8.50 | 2.8.50 |
| symfony/proxy-manager-bridge | composer | >= 3.0.0, < 3.4.26 | 3.4.26 |
| symfony/proxy-manager-bridge | composer | >= 4.0.0, < 4.1.12 | 4.1.12 |
| symfony/proxy-manager-bridge | composer | >= 4.2.0, < 4.2.7 | 4.2.7 |
| symfony/symfony | composer | >= 2.7.0, < 2.7.51 | 2.7.51 |
| symfony/symfony | composer | >= 2.8.0, < 2.8.50 | 2.8.50 |
| symfony/symfony | composer | >= 3.0.0, < 3.4.26 | 3.4.26 |
| symfony/symfony | composer | >= 4.0.0, < 4.1.12 | 4.1.12 |
| symfony/symfony | composer | >= 4.2.0, < 4.2.7 | 4.2.7 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from two key issues: 1) Missing validation in service ID setters (setAlias/setDefinition) allowing dangerous characters, and 2) Unsafe string interpolation in code generation (ProxyDumper/PhpDumper). The commit adds ID validation via strcspn() checks and replaces direct string interpolation with var_export/doExport escaping. The CWE-89 mapping confirms this is an injection flaw caused by improper neutralization of special elements in SQL/PHPDumper contexts when service IDs are user-controlled.