Symphony Vulnerable to PHP Code Injection via YAML Parsing
Date: 2022-05
Affected: composer/symfony/yaml, composer/symfony/symfony
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2013-1348
CWE: CWE-94

The `Yaml::parse` function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.


Mitigations:

Architectural layers (MAESTRO):