Unscored severity · published Dec 18, 2012
CVE-2012-5574
lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request
–
CVSS
3.5%
EPSS
No
On KEV
Description
lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Symfony · Sensiolabs
through 1.4.19; 1.4.0; 1.4.0; 1.4.0; 1.4.1; 1.4.2; +16 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5574
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093698.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093920.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/093922.html
Vendor Advisory
http://secunia.com/advisories/51372
Patch
http://symfony.com/blog/security-release-symfony-1-4-20-released
Patch
http://trac.symfony-project.org/changeset/33598
More from Symfony
9.8
CVE-2026-47767
Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
9.8
CVE-2024-51736
Command execution hijack on Windows with Process class in symfony/process
9.8
CVE-2019-18889
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7
9.8
CVE-2019-11325
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8
9.8
CVE-2017-11365
Certain Symfony products are affected by: Incorrect Access Control