Lucene search

[email protected]CVE-2021-41270

HistoryNov 24, 2021 - 7:15 p.m.

CVE-2021-41270

2021-11-2419:15:07

CWE-1236

[email protected]

web.nvd.nist.gov

symonfy

serializer

cve-2021-41270

vulnerability

csv injection

formula injection

php framework

web applications

console applications

data structures

owasp

nvd

security

information security

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

47.3%

JSON

Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony 4.1, maintainers added the opt-in csv_escape_formulas option in the CsvEncoder, to prefix all cells starting with =, +, - or @ with a tab \t. Since then, OWASP added 2 chars in that list: Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab \t) part of the vulnerable characters, and OWASP suggests using the single quote ' for prefixing the value. Starting with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendations and uses the single quote ' to prefix formulas and add the prefix to cells starting by \t, \r as well as =, +, - and @.

Affected configurations

Vulners

NVD

Node

symfonytwigRange4.1.0–4.4.35

symfonytwigRange5.0.0–5.3.12

VendorProductVersionCPE
symfonytwig*cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*
symfonytwig*cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
symfony	twig	*	cpe:2.3:a:symfony:twig::::::::
symfony	twig	*	cpe:2.3:a:symfony:twig::::::::

CNA Affected

[
  {
    "product": "symfony",
    "vendor": "symfony",
    "versions": [
      {
        "status": "affected",
        "version": ">= 4.1.0, < 4.4.35"
      },
      {
        "status": "affected",
        "version": ">= 5.0.0, < 5.3.12"
      }
    ]
  }
]