CVE-2023-46735 Symfony potential Cross-site Scripting in WebhookController

What is CVE-2023-46735?

CVE-2023-46735 is a medium-severity cross-site scripting vulnerability in Sensiolabs Symfony, published on 10 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now doesn't return any user-submitted input in its response.

Weakness: CWE-79

Which versions are affected by CVE-2023-46735?

5 open source packages ship an affected version, including symfony/symfony, symfony and symfony/webhook. It affects 1 product.

Products include Sensiolabs Symfony.

How do I fix CVE-2023-46735?

Upgrade symfony/symfony to 6.3.8 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-46735 being exploited?

There is no known exploitation of CVE-2023-46735 in the wild and no public exploit code.

Other vulnerabilities in Sensiolabs Symfony

• CVE-2019-11325 Improper Input Validation in Symfony Critical 9.8
• CVE-2017-11365 Symfony Incorrect Access Control Critical 9.8
• CVE-2019-10913 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony Critical 9.8
• CVE-2018-11407 Symfony Authentication Bypass Critical 9.8
• CVE-2016-2403 Symfony Authentication Bypass Critical 9.8

All Sensiolabs Symfony vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-symfony-2023-46735, GHSA-72x2-5c85-6wmr.