| Package | Affected versions | Patched versions |
|---|---|---|
| symfony/dependency-injection | ≥ 2.7.0, < 2.7.51≥ 2.8.0, < 2.8.50≥ 3.0.0, < 3.4.26≥ 4.0.0, < 4.1.12≥ 4.2.0, < 4.2.7 | 2.7.512.8.503.4.264.1.124.2.7 |
| symfony/proxy-manager-bridge | ≥ 2.7.0, < 2.7.51≥ 2.8.0, < 2.8.50≥ 3.0.0, < 3.4.26≥ 4.0.0, < 4.1.12≥ 4.2.0, < 4.2.7 | 2.7.512.8.503.4.264.1.124.2.7 |
| symfony/symfony | ≥ 2.7.0, < 2.7.51≥ 2.8.0, < 2.8.50≥ 3.0.0, < 3.4.26≥ 4.0.0, < 4.1.12≥ 4.2.0, < 4.2.7 | 2.7.512.8.503.4.264.1.124.2.7 |
| drupal | ≥ 8.5.0, < 8.5.15≥ 8.6.0, < 8.6.15 | 8.5.158.6.15 |
| symfony | ≥ 2.7.0, < 2.7.51≥ 2.8.0, < 2.8.50≥ 3.4.0, < 3.4.26≥ 4.1.0, < 4.1.12≥ 4.2.0, < 4.2.7 | 2.7.512.8.503.4.264.1.124.2.7 |
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free