Vulnerability · Published Dec 9, 2021 · Assigned by mitre
CVE-2021-43608
Critical 9.8
In plain English
A critical-severity security flaw in the doctrine/dbal package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.4%top 15.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | doctrine/dbal | 3.1.4 | GHSA-r7cj-8hjg-x622 |
Affected products (as reported)
References
- https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d x_refsource_MISC
- https://www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html x_refsource_MISC
- https://github.com/doctrine/dbal/releases x_refsource_MISC
- https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622 x_refsource_CONFIRM