PT-2024-40149 · Doctrine · Doctrine Dbal

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Doctrine DBAL (affected versions not specified)

Description: The identifier quoting in Doctrine DBAL has a potential security issue when user-input is passed into the quoting function, rendering the security aspect of this functionality obsolete.

Recommendations: Upgrade to the latest version of DBAL to resolve the issue. As a temporary workaround, consider avoiding the use of user-input in the quoteIdentifier() function until a patch is available.

Fix

Related Identifiers

GHSA-76W8-MQX4-WJRF

Affected Products

Doctrine Dbal

References · 4

• https://osv.dev/vulnerability/GHSA-76w8-mqx4-wjrf · Vendor Advisory
• https://github.com/doctrine/dbal · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/dbal/2011-09-25.yaml · Note
• https://web.archive.org/web/20130208100252/https://doctrine-project.org/blog/dbal-security-2011-1.html · Note