CVE-2019-11325 | BDVDB-2026-126421 Detail

Description#

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3
https://symfony.com/blog/symfony-4-3-8-released
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter

Exploit#

No public exploit known

History#

Version 12019-11-21Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.