{"id":"CVE-2014-4931","aliases":[],"url":"https://o3.security/vulnerability/CVE-2014-4931","summary":"Code injection in the way Symfony implements translation caching in FrameworkBundle","details":"When investigating issue [#11093](https://github.com/symfony/symfony/issues/11093), [Jeremy Derussé](https://connect.sensiolabs.com/profile/jderusse) found a serious code injection issue in the way Symfony implements translation caching in FrameworkBundle.\n\n- Your Symfony application is vulnerable if you meet the following conditions:\n\n- You are using the Symfony translation system from FrameworkBundle (so basically if you are using Symfony full-stack -- you are not affected if you are using the Translation component with Silex for instance);\nYou don't sanitize locales coming from a URL (any route with a _locale argument for instance):\n\nWhen vulnerable, an attacker can submit a non-valid locale value that can contain some PHP code that will be executed by Symfony. That's because the locale value is dumped into a PHP file generated in the cache without being sanitized first.","published":"2024-05-30T00:21:25Z","modified":"2024-05-30T00:41:45.562928Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"symfony/framework-bundle","fixedVersion":"2.3.18"},{"ecosystem":"Packagist","name":"symfony/framework-bundle","fixedVersion":"2.4.8"},{"ecosystem":"Packagist","name":"symfony/framework-bundle","fixedVersion":"2.5.2"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.3.19"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.4.9"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.5.4"}],"fix":{"url":"https://github.com/symfony/symfony/commit/06a80fbdbe744ad6f3010479ba64ef5cf35dd9af.patch","label":"symfony/symfony@06a80fb"},"references":[{"type":"WEB","url":"https://github.com/symfony/symfony/commit/06a80fbdbe744ad6f3010479ba64ef5cf35dd9af.patch"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2014-4931.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-4931.yaml"},{"type":"WEB","url":"https://symfony.com/blog/security-releases-cve-2014-4931-symfony-2-3-18-2-4-8-and-2-5-2-released"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-05-30T00:41:45.562928Z"}}