PT-2024-34155 · Symfony+5 · Symfony Httpfoundation+5

Zer0Yu · Published 2024-10-29 · Updated 2025-07-01 · CVE-2024-50345

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: symfony/http-foundation versions prior to 5.4.46 symfony/http-foundation versions prior to 6.4.14 symfony/http-foundation versions prior to 7.1.7

Description: The Request class in symfony/http-foundation does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. The issue has been patched, and users are advised to upgrade. There are no known workarounds for this issue.

Recommendations: For versions prior to 5.4.46, upgrade to version 5.4.46 or later. For versions prior to 6.4.14, upgrade to version 6.4.14 or later. For versions prior to 7.1.7, upgrade to version 7.1.7 or later. As a temporary workaround, consider validating URLs manually to ensure they do not contain invalid characters as defined by https://url.spec.whatwg.org/ until a patch is applied.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2025-07865

CVE-2024-50345

DLA-4200-1

DSA-5809-1

GHSA-MRQX-RP3W-JPJP

USN-7272-1

Affected Products

Astra Linux

Debian

Linuxmint

Red Os

Ubuntu

Symfony Httpfoundation

References · 40

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50345.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2024-50345.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50345.yaml · Exploit
• https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-51996 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24895 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mrqx-rp3w-jpjp · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50345 · Security Note
• https://osv.dev/vulnerability/DSA-5809-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24894 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-50345 · Security Note
• https://osv.dev/vulnerability/DLA-4200-1 · Vendor Advisory