PT-2024-40395 · Unknown · Fosrestbundle

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions FOSRestBundle versions 1.2.0 through 1.2.1

Description The issue arises from incorrect validation of the JSONP callback query parameter name instead of its value, affecting users of the JSONP handler with FOSRestBundle.

Recommendations For FOSRestBundle versions 1.2.0 and 1.2.1, update to FOSRestBundle version 1.2.2 to resolve the issue.

Related Identifiers

GHSA-P9FG-J6WW-953M

Affected Products

Fosrestbundle

References · 5

• https://osv.dev/vulnerability/GHSA-p9fg-j6ww-953m · Vendor Advisory
• https://github.com/FriendsOfSymfony/FOSRestBundle/commit/3dd7d40068360c23366fb4884c5d194c769ec2c1 · Note
• https://github.com/FriendsOfSymfony/FOSRestBundle · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/rest-bundle/2014-01-22-1.yaml · Note
• https://symfony.com/blog/fosrestbundle-security-issue-with-jsonp-handler · Note