auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

TRUNG BÌNH 6.1CVE-2024-45592 · GHSA-78vg-7v27-hj67 · Công bố 10/09/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-45592 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng damienharper/auditor-bundle, auditor-bundle (damienharper).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.45%, cao hơn 39.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.2.6 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
damienharper/auditor-bundle Packagist	`< 5.2.6`	`5.2.6`
auditor-bundle damienharper	`≥ 5.0.0, < 5.2.6`	`5.2.6`

Mô tả

Summary

Unescaped entity property enables Javascript injection.

Details

I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.

PoC

clone example project https://github.com/DamienHarper/auditor-bundle-demo
create author with FullName <script>alert()</script>
delete author
view audit of authors
alert is displayed

Impact

persistent XSS. JS can be injected and executed.

Mô tả của NVD

auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because `%source_label%` in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.