CVE-2014-4931

CVE-2014-4931 · Code injection in the way Symfony implements translation caching in FrameworkBundle

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When investigating issue [#11093](https://github.com/symfony/symfony/issues/11093), [Jeremy Derussé](https://connect.sensiolabs.com/profile/jderusse) found a serious code injection issue in the way Symfony implements translation caching in FrameworkBundle. - Your Symfony application is vulnerable if you meet the following conditions: - You are using the Symfony translation system from FrameworkBundle (so basically if you are using Symfony full-stack -- you are not affected if you are using the Translation component with Silex for instance); You don't sanitize locales coming from a URL (any route with a _locale argument for instance): When vulnerable, an attacker can submit a non-valid locale value that can contain some PHP code that will be executed by Symfony. That's because the locale value is dumped into a PHP file generated in the cache without being sanitized first.

CVSS 7.5 · High · Fix available

Published

2024-05-30T00:21:25Z

Updated

2024-05-30T00:41:45.562928Z

Stack: php

Check your server →