PT-2023-7209 · Symfony+5 · Symfony+5

Rudloff · Published 2023-11-10 · Updated 2025-03-14 · CVE-2023-46734

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions 2.0.0 through 4.4.50 Symfony versions 5.0.0 through 5.4.30 Symfony versions 6.0.0 through 6.3.7

Description The issue exists due to some Twig filters in CodeExtension using is safe=html but not ensuring their input is safe. This could allow a remote attacker to disclose protected information, perform phishing attacks, and conduct drive-by downloads. Symfony now escapes the output of the affected filters to resolve the issue.

Recommendations For Symfony versions 2.0.0 through 4.4.50, update to version 4.4.51 or later. For Symfony versions 5.0.0 through 5.4.30, update to version 5.4.31 or later. For Symfony versions 6.0.0 through 6.3.7, update to version 6.3.8 or later. As a temporary workaround, consider restricting the use of the affected Twig filters in CodeExtension until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2024-1028

ALT-PU-2024-4537

ALT-PU-2024-4547

ALT-PU-2024-4961

ALT-PU-2025-4212

BDU:2023-08237

BIT-SYMFONY-2023-46734

CVE-2023-46734

DLA-3664-1

GHSA-Q847-2Q57-WMR3

USN-7272-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Os

Symfony

Ubuntu

References · 37

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46734.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2023-46734.yaml · Exploit
• https://github.com/symfony/symfony/security/advisories/GHSA-q847-2q57-wmr3 · Vendor Advisory
• https://github.com/symfony/symfony/commit/5d095d5feb1322b16450284a04d6bb48d1198f54 · Patch
• https://github.com/symfony/symfony/commit/9da9a145ce57e4585031ad4bee37c497353eec7c · Patch
• https://ubuntu.com/security/CVE-2024-50340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50343 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24895 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50345 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46734 · Security Note
• https://osv.dev/vulnerability/DLA-3664-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46734 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-46734 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory