An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
07 Nov 2023, 03:07
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2019-11-21 23:15
Updated : 2024-02-28 17:28
NVD link : CVE-2019-18888
Mitre link : CVE-2019-18888
CVE.ORG link : CVE-2019-18888
JSON object : View
Products Affected
fedoraproject
- fedora
sensiolabs
- symfony
CWE
CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')