Symphony Vulnerable to PHP Code Injection via YAML Parsing

高危 7.5CVE-2013-1348 · GHSA-2r5h-6r7v-5m7c · Published 02/06/2014 · updated 16/06/2026

要点

CVE-2013-1348 是影响 symfony/symfony, symfony/yaml, symfony (sensiolabs) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.6%，高于 76.1% 的漏洞。
修复：升级到 2.0.22 或更高版本。

Package	Affected versions	Patched versions
symfony/symfony Packagist	`≥ 2.0.0, < 2.0.22`	`2.0.22`
symfony/yaml Packagist	`≥ 2.0.0, < 2.0.22`	`2.0.22`
symfony sensiolabs	`= 2.0.0= 2.0.1= 2.0.10= 2.0.11= 2.0.12= 2.0.13= 2.0.14= 2.0.15= 2.0.16= 2.0.17= 2.0.18= 2.0.19= 2.0.2= 2.0.20= 2.0.21= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.0.7= 2.0.8= 2.0.9`	No fix yet

Description

The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.

NVD description

The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.

References

nvd.nist.gov/vuln/detail/CVE-2013-1348 · ADVISORY
symfony/symfony commit ac756bf · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/81550 · WEB
FriendsOfPHP/security-advisories · WEB
FriendsOfPHP/security-advisories · WEB
symfony/symfony · PACKAGE
symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released · WEB
web.archive.org/web/20150612022223/http://www.securityfocus.com/bid/57574 · WEB
secunia.com/advisories/51980
symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released · Vendor Advisory
securityfocus.com/bid/57574

symfony/symfony 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

symfony/symfony

Packagist

≥ 2.0.0, < 2.0.22

2.0.22

symfony/yaml

Packagist

≥ 2.0.0, < 2.0.22

2.0.22

symfony

sensiolabs

= 2.0.0= 2.0.1= 2.0.10= 2.0.11= 2.0.12= 2.0.13= 2.0.14= 2.0.15= 2.0.16= 2.0.17= 2.0.18= 2.0.19= 2.0.2= 2.0.20= 2.0.21= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.0.7= 2.0.8= 2.0.9

No fix yet

Description

The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.

NVD description

The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.

symfony/symfony 的其他漏洞

查看全部 →