CVE-2023-41336 Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete

2023-09-1119:21:48

CWE-20

GitHub_M

www.cve.org

cve-2023-41336

injection prevention

symfony ux-autocomplete

entitytype

javascript

entity id

security fix

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

20.0%

JSON

ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices. The problem has been fixed in symfony/ux-autocomplete version 2.11.2.

CNA Affected

[
  {
    "vendor": "symfony",
    "product": "ux-autocomplete",
    "versions": [
      {
        "version": "< 2.11.2",
        "status": "affected"
      }
    ]
  }
]