CVE-2023-41336: falha de média gravidade em symfony ux-autocomplete
Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.6%
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an `EntityType` that is *not* part of the valid choices. The problem has been fixed in `symfony/ux-autocomplete` version 2.11.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
symfony · ux-autocompleteReferências
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2023-41336.yamlhttps://github.com/symfony/ux-autocomplete/commit/fabcb2eee14b9e84a45b276711853a560b5d770chttps://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79xhttps://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax