Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-Q847-2Q57-WMR3
HistoryNov 12, 2023 - 3:52 p.m.

Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters

2023-11-1215:52:51
CWE-79
GitHub Advisory Database
github.com
17
symfony
twig
filters
potential
cross-site scripting
vulnerabilities
codeextension

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

7

Confidence

Low

EPSS

0.001

Percentile

20.4%

JSON

Description

Some Twig filters in CodeExtension use “is_safe=html” but don’t actually ensure their input is safe.

Resolution

Symfony now escapes the output of the affected filters.

The patch for this issue is available here for branch 4.4.

Credits

We would like to thank Pierre Rudloff for reporting the issue and to Nicolas Grekas for providing the fix.

Affected configurations

Vulners
Node
symfonysymfonyRange6.0.0–6.3.8
OR
symfonysymfonyRange5.0.0–5.4.31
OR
symfonysymfonyRange2.0.0–4.4.51
OR
symfonytwigRange6.0.0–6.3.8
OR
symfonytwigRange5.0.0–5.4.31
OR
symfonytwigRange2.0.0–4.4.51
VendorProductVersionCPE
symfonysymfony*cpe:2.3:a:symfony:symfony:*:*:*:*:*:*:*:*
symfonytwig*cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*

Related

osv 4
ubuntucve 1
cve 1
veracode 1
openvas 1
debiancve 1
cvelist 1
prion 1
symfony 1
friendsofphp 2
nvd 1
vulnrichment 1
nessus 1
debian 1
redos 1
osv
osv
CVE-2023-46734
2023-11-10 18:15:09
Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
2023-11-12 15:52:51
BIT-symfony-2023-46734
2024-03-06 11:06:44
ubuntucve
ubuntucve
CVE-2023-46734
2023-11-10 00:00:00
cve
cve
CVE-2023-46734
2023-11-10 18:15:09
veracode
veracode
Cross Site Scripting (XSS)
2023-11-13 08:57:55
openvas
openvas
Debian: Security Advisory (DLA-3664-1)
2023-11-27 00:00:00
debiancve
debiancve
CVE-2023-46734
2023-11-10 18:15:09
cvelist
cvelist
CVE-2023-46734 Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
2023-11-10 17:49:55
prion
prion
Design/Logic Flaw
2023-11-10 18:15:00
symfony
symfony
CVE-2023-46734: Potential XSS vulnerabilities in CodeExtension filters
2023-11-10 00:00:00
friendsofphp
friendsofphp
CVE-2023-46734: Potential XSS vulnerabilities in CodeExtension filters
1970-01-01 00:00:00
CVE-2023-46734: Potential XSS vulnerabilities in CodeExtension filters
1970-01-01 00:00:00
nvd
nvd
CVE-2023-46734
2023-11-10 18:15:09
vulnrichment
vulnrichment
CVE-2023-46734 Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
2023-11-10 17:49:55
nessus
nessus
Debian DLA-3664-1 : symfony - LTS security update
2023-11-24 00:00:00
debian
debian
[SECURITY] [DLA 3664-1] symfony security update
2023-11-24 18:22:20
redos
redos
ROS-20240806-05
2024-08-06 00:00:00

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

7

Confidence

Low

EPSS

0.001

Percentile

20.4%

JSON
Related for GHSA-Q847-2Q57-WMR3
osv4ubuntucve1cve1veracode1openvas1debiancve1cvelist1prion1symfony1friendsofphp2nvd1vulnrichment1nessus1debian1redos1