CVE-2023-37473 Limited code execution in zenstruck/collections
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2023-37473?
CVE-2023-37473 is a high-severity vulnerability in zenstruck collection, published on 14 Jul 2023.
Official description
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.
Weakness: CWE-74
Which versions are affected by CVE-2023-37473?
2 open source packages ship an affected version, including zenstruck/collection. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zenstruck/collection Packagist | All versions | 0.2.1 |
zenstruck/collection Packagist | All versions | 0.2.1 |
Products include Zenstruck Collection.
How do I fix CVE-2023-37473?
Upgrade zenstruck/collection to 0.2.1 or later.
Is CVE-2023-37473 being exploited?
There is no known exploitation of CVE-2023-37473 in the wild and no public exploit code.
Sources
Also known as GHSA-7xr2-8ff7-6fjq.