Medium severity · published Nov 10, 2023
CVE-2023-46735
Symfony is a PHP framework for web and console applications and a set of reusable PHP components
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now doesn't return any user-submitted input in its response.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Symfony · Sensiolabs
6.0.0 before 6.3.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46735
Patch
https://github.com/symfony/symfony/commit/8128c302430394f639e818a7103b3f6815d8d962
Patch
https://github.com/symfony/symfony/security/advisories/GHSA-72x2-5c85-6wmr
More from Symfony
9.8
CVE-2026-47767
Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
9.8
CVE-2024-51736
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes
9.8
CVE-2019-18889
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7
9.8
CVE-2019-11325
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8
9.8
CVE-2017-11365
Certain Symfony products are affected by: Incorrect Access Control