zenstruck/collection passing callable string to EntityRepository::find() and query() · CVE-2023-37473 · GitHub Advisory Database · GitHub

zenstruck/collection passing callable string to EntityRepository::find() and query()

High severity GitHub Reviewed Published Jul 14, 2023 in zenstruck/collection • Updated Nov 10, 2023

Package

zenstruck/collection (Composer)

Affected versions

< 0.2.1

Patched versions

0.2.1

Description

Impact

Passing callable strings (ie system) caused the function to be executed.

Patches

Fixed in v0.2.1.

Workarounds

Do not allow passing user strings to EntityRepository::find() or query().

References

References

kbond published to zenstruck/collection

Jul 14, 2023

Published by the National Vulnerability Database

Jul 14, 2023

Published to the GitHub Advisory Database Jul 14, 2023

Reviewed Jul 14, 2023

Last updated Nov 10, 2023

Severity

High

8.6

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

Low

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H