Detections
Analytics

SCA: security update for friendsofsymfony1/swiftmailer, friendsofsymfony1/symfony1, swiftmailer/swiftmailer (GHSA-wjv8-pxr6-5f4r)

critical Tenable Cloud Security Plugin ID 419977

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better
 performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift
 Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize
 user input in his project. This vulnerability present no direct threat but is a vector that will enable
 remote code execution if a developper deserialize user untrusted data. Symfony 1 depends on Swift Mailer
 which is bundled by default in vendor directory in the default installation since 1.3.0. Swift Mailer
 classes implement some `__destruct()` methods. These methods are called when php destroys the object in
 memory. However, it is possible to include any object type in `$this->_keys` to make PHP access to another
 array/object properties than intended by the developer. In particular, it is possible to abuse the array
 access which is triggered on foreach($this->_keys ...) for any class implementing ArrayAccess interface.
 This may allow an attacker to execute any PHP command which leads to remote code execution. This issue has
 been addressed in version 1.5.18. Users are advised to upgrade. There are no known workarounds for this
 vulnerability. (CVE-2024-28859)

See Also

https://github.com/advisories/GHSA-wjv8-pxr6-5f4r

Plugin Details

Severity: Critical

ID: 419977

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.66

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-28859

CVSS v3

Risk Factor: Critical

Base Score: 9

Temporal Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/18/2024

Vulnerability Publication Date: 3/15/2024

Reference Information

CVE: CVE-2024-28859

cwe: CWE-502