CVE-2024-50343 — Improper Input Validation in Symfony

CWE-20 — Improper Input Validation7 documents6 sources
Severity
3.1LOWNVD
EPSS
0.2%
top 52.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SymfonySymfony Validator
Timeline
PublishedNov 6
Latest updateFeb 18

Description

symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.6 | Impact: 1.4

Affected Packages4 packages

▶Packagistsymfony/validator6.0.0 — 6.4.11+2
▶CVEListV5symfony/symfony< 5.4.43+2
▶Packagistsymfony/symfony6.0.0 — 6.4.11+2
▶Debiansymfony/symfony< 4.4.19+dfsg-2+deb11u7+3

🔴Vulnerability Details

4
GHSA
Symfony has an incorrect response from Validator when input ends with `\n`↗2024-11-06
▶
OSV
Symfony has an incorrect response from Validator when input ends with `\n`↗2024-11-06
▶
OSV
CVE-2024-50343: symfony/validator is a module for the Symphony PHP framework which provides tools to validate values↗2024-11-06
▶
CVEList
Incorrect response from Validator when input ends with `\n` in symfony/validator↗2024-11-06
▶

📋Vendor Advisories

2
Ubuntu
Symfony vulnerabilities↗2025-02-18
▶
Debian
CVE-2024-50343: symfony - symfony/validator is a module for the Symphony PHP framework which provides tool...↗2024
▶
CVE-2024-50343 — Improper Input Validation in Symfony | cvebase