CyberRota Analysis
AI-GeneratedThe vulnerability affects Symfony versions from 6.1.0 to 6.4.41, as well as 7.4.13 and 8.0.13, allowing URL-bearing attributes in certain HTML elements to bypass URL sanitization. This could enable attackers to inject malicious JavaScript payloads into sanitized output, potentially leading to cross-site scripting (XSS) attacks. Developers and organizations using the affected Symfony versions should prioritize updating to the fixed versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.
Related CVEs
Other vulnerabilities affecting the same vendor(s)