p PatchFirst

CVE-2024-28861

CVE-2024-28861 · Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.

CVSS 9.8 · Critical · EPSS 1.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • symfony1

    Versions
    • >= 1.1.0, < 1.5.19: Affected

    No fix published

  • friendsofsymfony1/symfony1 Packagist

    Versions
    • v1.5.10
    • v1.5.11
    • v1.5.12
    • v1.5.13
    • v1.5.14
    • v1.5.15
    • v1.5.16
    • v1.5.17
    • v1.5.18
    • v1.5.7
    • v1.5.8
    • v1.5.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.1.0, < 1.5.19

    Update to 1.5.19

Original sources

Check your server →