CyberRota Analysis
AI-GeneratedThe vulnerability affects Symfony versions from 6.1.0-BETA1 up to 6.4.40, 7.4.12, and 8.0.12, specifically within the UrlSanitizer::parse() function, which improperly handles Unicode BiDi formatting characters. This flaw allows attackers to create visually deceptive links in sanitized content, potentially leading to phishing attacks. Organizations using affected Symfony versions should prioritize updating to the patched releases to mitigate the risk of visual spoofing.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized content to display a link destination that visually differs from the actual destination and enabling phishing-style visual spoofing. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Related CVEs
Other vulnerabilities affecting the same vendor(s)