CVE-2013-4751 Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
The Symfony Validator library loses information during serialization, potentially allowing attackers to modify data integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-4751?
CVE-2013-4751 is a high-severity unsafe deserialization vulnerability in Fedoraproject Fedora, published on 1 Nov 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
php-symfony2-Validator has loss of information during serialization
Weakness: CWE-20
Which versions are affected by CVE-2013-4751?
16 open source packages ship an affected version, including symfony/symfony and symfony/validator. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
symfony/symfony Packagist | From 2.0.0 | 2.0.24 |
symfony/symfony Packagist | From 2.0.0 | 2.0.24 |
symfony/symfony Packagist | From 2.1.0 | 2.1.12 |
symfony/symfony Packagist | From 2.1.0 | 2.1.12 |
symfony/symfony Packagist | From 2.2.0 | 2.2.5 |
symfony/symfony Packagist | From 2.2.0 | 2.2.5 |
10 more packages
symfony/symfony Packagist | From 2.3.0 | 2.3.3 |
symfony/symfony Packagist | From 2.3.0 | 2.3.3 |
symfony/validator Packagist | From 2.0.0 | 2.0.24 |
symfony/validator Packagist | From 2.0.0 | 2.0.24 |
symfony/validator Packagist | From 2.1.0 | 2.1.12 |
symfony/validator Packagist | From 2.1.0 | 2.1.12 |
symfony/validator Packagist | From 2.2.0 | 2.2.5 |
symfony/validator Packagist | From 2.2.0 | 2.2.5 |
symfony/validator Packagist | From 2.3.0 | 2.3.3 |
symfony/validator Packagist | From 2.3.0 | 2.3.3 |
Products include Fedoraproject Fedora, Redhat Enterprise Linux, Sensiolabs Symfony.
How do I fix CVE-2013-4751?
Upgrade symfony/symfony to a fixed version for your release line: 2.0.24, 2.1.12, 2.2.5 or 2.3.3.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2013-4751 being exploited?
There is no known exploitation of CVE-2013-4751 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-q8j7-fjh7-25v5.