Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters

中 6.1CVE-2023-46734 · BIT-symfony-2023-46734 · GHSA-q847-2q57-wmr3 · 10/11/2023 公開 · 29/07/2026 更新

要点

CVE-2023-46734 は symfony/symfony, symfony/twig-bridge, symfony (sensiolabs) に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.69%（全脆弱性の 52.7% より高い）。
対処：4.4.51, 5.4.31, 6.3.8 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
symfony/symfony Packagist	`≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8`	`4.4.515.4.316.3.8`
symfony/twig-bridge Packagist	`≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8`	`4.4.515.4.316.3.8`
symfony sensiolabs	`≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8`	`4.4.515.4.316.3.8`
twig-bridge symfony	`≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8`	`4.4.515.4.316.3.8`

概要

Description

Some Twig filters in CodeExtension use "is_safe=html" but don't actually ensure their input is safe.

Resolution

Symfony now escapes the output of the affected filters.

The patch for this issue is available here for branch 4.4.

Credits

We would like to thank Pierre Rudloff for reporting the issue and to Nicolas Grekas for providing the fix.

NVD の説明

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.