CyberRota Analysis
AI-GeneratedThe vulnerability affects Symfony versions 6.1.0 to 6.4.41, 7.4.13, and 8.0.13, allowing attackers to exploit the UrlSanitizer::parse() function, which fails to properly handle percent-encoded BiDi formatting characters. This oversight can lead to visual spoofing in sanitized URLs, potentially misleading users or applications that display these URLs. Organizations using affected Symfony versions should prioritize upgrading to the fixed versions to mitigate the risk of phishing and other social engineering attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs to retain visual-spoofing characters that downstream consumers could decode or display. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.
Related CVEs
Other vulnerabilities affecting the same vendor(s)