CVE-2024-28861

Summary

CVE-2024-28861 affects the Symfony 1 branch of the popular PHP web framework. This vulnerability, present in versions prior to 1.5.19, enables remote code execution due to dangerous deserialization in the `sfNamespacedParameterHolder` class. Attackers can exploit this gadget chain by manipulating user input, which, if deserializes by a developer, would result in arbitrary code execution. Developers using Symfony 1 are advised to upgrade to version 1.5.19 as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.