CVE-2023-46734CWE-79

Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters

Medium · published November 10, 2023

CVSS v3.1
6.1
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00688 · 52.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-11-10T17:49Z
EPSS history
Timeline
  • 10 NOV 17:49Z
    Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
    cvelistv5