PT-2023-7209 · Symfony+5 · Symfony+5
Rudloff
·
Publicado
2023-11-10
·
Atualizado
2025-03-14
·
CVE-2023-46734
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Symfony versions 2.0.0 through 4.4.50
Symfony versions 5.0.0 through 5.4.30
Symfony versions 6.0.0 through 6.3.7
Description
The issue exists due to some Twig filters in CodeExtension using
is safe=html but not ensuring their input is safe. This could allow a remote attacker to disclose protected information, perform phishing attacks, and conduct drive-by downloads. Symfony now escapes the output of the affected filters to resolve the issue.Recommendations
For Symfony versions 2.0.0 through 4.4.50, update to version 4.4.51 or later.
For Symfony versions 5.0.0 through 5.4.30, update to version 5.4.31 or later.
For Symfony versions 6.0.0 through 6.3.7, update to version 6.3.8 or later.
As a temporary workaround, consider restricting the use of the affected Twig filters in CodeExtension until a patch is applied.
Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Linuxmint
Red Os
Symfony
Ubuntu