CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
20.4%
Symfony versions >=2.0.0,<4.4.51, >=5.0.0,<5.4.31, and =6.0.0,<6.3.8 of the Symfony Twig Bridge are affected by this security issue.
The issue has been fixed in Symfony 4.4.51, 5.4.31, 6.3.8. All other versions are not maintained anymore.
Some filters in the CodeExtension
Twig extension use is_safe=html
but they don’t actually ensure their input is safe.
CodeExtension
is an internal Twig extension that should be only used in development environments. You might be affected only if you are using this extension explicitly in production environments.
As of Symfony 6.4, this extension has been marked as @internal
.
Symfony now escapes the output of the affected filters.
The patch for this issue is available here for branch 4.4.
We would like to thank Pierre Rudloff for reporting the issue and to Nicolas Grekas for providing the fix.
Log in to add a reaction to this post
add a reaction ❤️ 👍 🚀
Published in #Security Advisories
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
20.4%