CyberRota Analysis
AI-GeneratedThe Symfony PHP framework is vulnerable to improper validation of route parameters in versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, which can allow attackers to generate malicious protocol-relative URLs. This could potentially lead to phishing or redirection attacks, impacting the security of web applications using the affected versions. Developers and organizations utilizing Symfony should prioritize updating to the fixed versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives match as unanchored substrings, allowing a value such as //evil.com to satisfy a common locale requirement and generate a protocol-relative off-site URL. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Related CVEs
Other vulnerabilities affecting the same vendor(s)