p PatchFirst

GHSA-7jp2-5h22-m432

GHSA-7jp2-5h22-m432 · Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import

This page contains facts from public vulnerability sources. Check the original advisory before updating.

### Overview In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. ### Am I affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the Auth0 Symfony SDK with versions between 2.0.2 and 5.4.1, 2. Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0. ### Fix Upgrade Auth0/symfony to version 5.5.0 or greater. ### Acknowledgement Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

CVSS 3.3 · Low · Fix available

Published
Updated

Stack: php

Affected products and versions

  • auth0/symfony Packagist

    Versions
    • 2.0.2
    • 2.0.3
    • 3.0.0
    • 3.0.0-beta.1
    • 3.0.0-beta.2
    • 3.0.0-beta.3
    • 3.0.0-beta.4
    • 3.0.0-beta.5
    • 3.0.0-rc.1
    • 3.0.1
    • 3.0.2
    • 3.1.0
    • 3.2.0
    • 3.3.0
    • 3.3.1
    • 3.4.0
    • 4.0.0
    • 5.0.0
    • 5.0.0-BETA0
    • 5.0.0-BETA1
    • 5.1.0
    • 5.2.0
    • 5.2.1
    • 5.2.2
    • 5.2.3
    • 5.3.0
    • 5.3.1
    • 5.4.0
    • 5.4.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.2, < 5.5.0

    Update to 5.5.0

Original sources

Check your server →