CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-10910
Critical (9.8). EPSS 6.0% chance of exploitation in the next 30 days.
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Severity
- EPSS
- 6.0% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- drupal:drupal
- sensiolabs:symfony
References
- https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
- https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
- https://www.synology.com/security/advisory/Synology_SA_19_19
- https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
- https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid