CVE-2024-28861

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
FriendsOfSymfony1	symfony1	>= 1.1.0, < 1.5.19
friends_of_symfony_project	fosuserbundle	>= 1.1.0, < 1.5.19

References

https://github.com/FriendsOfSymfony1/symfony1/commit/0bd9d59c69221f49bfc8be8b871b79e12d7d171aPatch
https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-pv9j-c53q-h433Exploit, Mitigation, Vendor Advisory
https://github.com/FriendsOfSymfony1/symfony1/commit/0bd9d59c69221f49bfc8be8b871b79e12d7d171aPatch
https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-pv9j-c53q-h433Exploit, Mitigation, Vendor Advisory

Timeline

Published: Mar 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-288625.5The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had CVE-2024-288636.5node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation proc CVE-2024-288642.6SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps CVE-2024-288657.5django-wiki is a wiki system for Django. Installations of django-wiki prior to version 0.10.1 are vulnerable to maliciously crafted article CVE-2024-288666.1GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 (inclusive) are potentially vulnerable to a reflected cross-site s CVE-2024-288677.4Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _CVE-2024-288685.3Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possib CVE-2024-288697.5Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-len CVE-2024-28877.7Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML CVE-2024-288707.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF a CVE-2024-288717.5LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic,CVE-2024-288728.1The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the S