CVE-2023-46735: Cross-site scripting

November 10, 2023 (updated November 16, 2023)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in WebhookController returns unescaped user-submitted input. As of version 6.3.8, WebhookController now does not return any user-submitted input in its response.

References

github.com/symfony/symfony/commit/8128c302430394f639e818a7103b3f6815d8d962
github.com/symfony/symfony/security/advisories/GHSA-72x2-5c85-6wmr
nvd.nist.gov/vuln/detail/CVE-2023-46735

Code Behaviors & Features

Detect and mitigate CVE-2023-46735 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →