Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters

TRUNG BÌNH 6.1CVE-2023-46734 · BIT-symfony-2023-46734 · GHSA-q847-2q57-wmr3 · Công bố 10/11/2023 · cập nhật 29/07/2026

Tóm tắt nhanh

CVE-2023-46734 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng symfony/symfony, symfony/twig-bridge, symfony (sensiolabs).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.69%, cao hơn 52.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.4.51, 5.4.31, 6.3.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
symfony/symfony Packagist	`≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8`	`4.4.515.4.316.3.8`
symfony/twig-bridge Packagist	`≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8`	`4.4.515.4.316.3.8`
symfony sensiolabs	`≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8`	`4.4.515.4.316.3.8`
twig-bridge symfony	`≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8`	`4.4.515.4.316.3.8`

Mô tả

Description

Some Twig filters in CodeExtension use "is_safe=html" but don't actually ensure their input is safe.

Resolution

Symfony now escapes the output of the affected filters.

The patch for this issue is available here for branch 4.4.

Credits

We would like to thank Pierre Rudloff for reporting the issue and to Nicolas Grekas for providing the fix.

Mô tả của NVD

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.