CVE-2024-28861

CRITICAL

symfony1 1.1.0-1.5.18 - Remote Code Execution via sfNamespacedParameterHolder Deserialization

Title source: llm
STIX 2.1

Description

Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0153
EPSS Percentile 71.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-502
Status published
Products (2)
friendsofsymfony1/symfony1 1.1.0 - 1.5.19Packagist
friendsofsymfony1/symfony1 1.1.0 - 1.5.9
Published Mar 22, 2024
Tracked Since Feb 18, 2026