Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
CVE-2023-46734

6.1MEDIUM

Key Information:

Vendor

Symfony

Status
Symfony
Vendor
CVE Published:
10 November 2023

What is CVE-2023-46734?

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use is_safe=html but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.

Affected Version(s)

symfony >= 2.0.0, < 4.4.51 < 2.0.0, 4.4.51

symfony >= 5.0.0, < 5.4.31 < 5.0.0, 5.4.31

symfony >= 6.0.0, < 6.3.8 < 6.0.0, 6.3.8

References

https://github.com/symfony/symfony/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/symfony/symfony/commit/5d095d5feb1322b...
x_refsource_MISC
https://github.com/symfony/symfony/commit/9da9a145ce57e45...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.