Kurz gesagt
- CVE-2023-37473 ist eine Schwachstelle (HOCH (CVSS 8.8)) in zenstruck/collection, collection (zenstruck).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.94%, höher als bei 61.2% aller Schwachstellen.
- Abhilfe: auf 0.2.1 oder neuer aktualisieren.
Description
Impact
Passing callable strings (ie system) caused the function to be executed.
Patches
Fixed in v0.2.1.
Workarounds
Do not allow passing user strings to EntityRepository::find() or query().
References
Fix commit.
NVD description
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free