CVE-2023-46734
mediumPriorität · verfolgen · 24EPSS 0.007 · 53. PerzentilEURUUSEPSS · bewertet 2026-10-27
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (30)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-q847-2q57-wmr3Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters2023-11-12ghsa · osvUS
### Description Some Twig filters in CodeExtension use "is_safe=html" but don't actually ensure their input is safe. ### Resolution Symfony now escapes the output of the affected filters. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9da9a145ce57e4585031ad4bee37c497353eec7c) for branch 4.4. ### Credits We would like to thank Pierre Rudloff for reporting the issue and to Nicolas Grekas for providing the fix.
- BIT-symfony-2023-467342024-03-06vendor · osvUS
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (13)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2023-46734/cnnvd
- https://github.com/symfony/symfony/commit/5d095d5feb1322b16450284a04d6bb48d1198f54cnnvd
- https://github.com/symfony/symfony/commit/9da9a145ce57e4585031ad4bee37c497353eec7ccnnvd
- https://github.com/symfony/symfony/security/advisories/GHSA-q847-2q57-wmr3cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.7068cnnvd
- https://github.com/symfony/symfony/commit/5d095d5feb1322b16450284a04d6bb48d1198f54enisa_euvd
- https://github.com/symfony/symfony/commit/9da9a145ce57e4585031ad4bee37c497353eec7cenisa_euvd
- https://github.com/symfony/symfony/security/advisories/GHSA-q847-2q57-wmr3enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan