PT-2024-27093 · Symfony · Symfony

Published 2024-11-29 · Updated 2024-12-24 · CVE-2024-36610

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symfony version 7.0.3

Description A deserialization vulnerability is reported to exist in the Stub class of the VarDumper module in Symfony. The issue stems from deficiencies in handling properties with null or uninitialized values, potentially allowing an attacker to construct specific serialized data and execute unauthorized code. However, it has been concluded that this is a false report.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-36610

GHSA-CG28-V4WQ-WHV5

Affected Products

Symfony

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-36610 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-36610 · Security Note
• https://ubuntu.com/security/CVE-2024-36610 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36610 · Security Note
• https://osv.dev/vulnerability/GHSA-cg28-v4wq-whv5 · Vendor Advisory
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/issues/59077#issuecomment-2513935018 · Note
• https://github.com/symfony/symfony/commit/3ffd495bb3cc4d2e24e35b2d83c5b909cab7e259 · Note
• https://github.com/symfony/symfony/blob/v7.0.3/src/Symfony/Component/VarDumper/Cloner/Stub.php#L53 · Note
• https://github.com/github/advisory-database/pull/5046 · Note
• https://github.com/github/advisory-database/pull/5048 · Note
• https://t.me/cvenotify/102957 · Telegram Post
• https://t.me/cvedetector/11687 · Telegram Post
• https://gist.github.com/1047524396/24e93f2905850235e42ad7db6e878bd5 · Note
• https://twitter.com/CVEnew/status/1862584920054669620 · Twitter Post