CVE-2023-41336 Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
Attackers can submit invalid entity IDs in autocomplete fields, bypassing validation and potentially modifying data in Symfony applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-41336?
CVE-2023-41336 is a medium-severity vulnerability in symfony ux-autocomplete, published on 11 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an `EntityType` that is *not* part of the valid choices. The problem has been fixed in `symfony/ux-autocomplete` version 2.11.2.
Weakness: CWE-20
Which versions are affected by CVE-2023-41336?
2 open source packages ship an affected version, including symfony/ux-autocomplete. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/ux-autocomplete Packagist | All versions | 2.11.2 |
symfony/ux-autocomplete Packagist | All versions | 2.11.2 |
Products include Symfony Ux Autocomplete.
How do I fix CVE-2023-41336?
Upgrade symfony/ux-autocomplete to 2.11.2 or later.
Is CVE-2023-41336 being exploited?
There is no known exploitation of CVE-2023-41336 in the wild and no public exploit code.
Sources
Also known as GHSA-4cpv-669c-r79x.