p PatchFirst

GHSA-7jp2-5h22-m432

GHSA-7jp2-5h22-m432 · Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

### Overview In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. ### Am I affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the Auth0 Symfony SDK with versions between 2.0.2 and 5.4.1, 2. Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0. ### Fix Upgrade Auth0/symfony to version 5.5.0 or greater. ### Acknowledgement Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

CVSS 3.3 · Faible · Correctif disponible

Publication
Mise à jour

Pile logicielle: php

Produits et versions concernés

  • auth0/symfony Packagist

    Versions du logiciel
    • 2.0.2
    • 2.0.3
    • 3.0.0
    • 3.0.0-beta.1
    • 3.0.0-beta.2
    • 3.0.0-beta.3
    • 3.0.0-beta.4
    • 3.0.0-beta.5
    • 3.0.0-rc.1
    • 3.0.1
    • 3.0.2
    • 3.1.0
    • 3.2.0
    • 3.3.0
    • 3.3.1
    • 3.4.0
    • 4.0.0
    • 5.0.0
    • 5.0.0-BETA0
    • 5.0.0-BETA1
    • 5.1.0
    • 5.2.0
    • 5.2.1
    • 5.2.2
    • 5.2.3
    • 5.3.0
    • 5.3.1
    • 5.4.0
    • 5.4.1
    Plages de versions concernées
    • ECOSYSTEM: ≥ 2.0.2, < 5.5.0

    Mettez à jour vers 5.5.0

Sources originales

Vérifiez votre serveur →