CVE-2024-28861
Critical
Description
Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.
SeverityCritical
CVSS9.8
Exploit probability—
ProductSymfony1
PublishedMar 22, 2024
First seenMar 22, 2024
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- friendsofsymfony1 symfony11.5.9 or later
- friendsofsymfony1/symfony11.5.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| friendsofsymfony1 symfony1 | 1.1.0 ≤ v < 1.5.9 | 1.5.9 |
| friendsofsymfony1/symfony1Packagist | 1.1.0 ≤ v < 1.5.19 | 1.5.19 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.