CVE-2024-50345
published 2024-11-06CVE-2024-50345: symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.56%
43.2th percentile
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | symfony | < symfony 5.4.23+dfsg-1+deb12u3 (bookworm) | symfony 5.4.23+dfsg-1+deb12u3 (bookworm) |
| sensiolabs | symfony | < 5.4.46 | 5.4.46 |
| sensiolabs | symfony | >= 6.0.0 < 6.4.14 | 6.4.14 |
| sensiolabs | symfony | >= 7.0.0 < 7.1.7 | 7.1.7 |
| symfony | http-foundation | >= 0 < 5.4.46 | 5.4.46 |
| symfony | http-foundation | >= 6.0.0 < 6.4.14 | 6.4.14 |
| symfony | http-foundation | >= 7.0.0 < 7.1.7 | 7.1.7 |
| symfony | symfony | < 5.4.46 | 5.4.46 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 0 < 4.4.19+dfsg-2+deb11u7 | 4.4.19+dfsg-2+deb11u7 |
| symfony | symfony | >= 0 < 5.4.23+dfsg-1+deb12u3 | 5.4.23+dfsg-1+deb12u3 |
| symfony | symfony | >= 0 < 6.4.14+dfsg-1 | 6.4.14+dfsg-1 |
| symfony | symfony | >= 0 < 6.4.14+dfsg-1 | 6.4.14+dfsg-1 |
| symfony | symfony | >= 0 < 4.3.8+dfsg-1ubuntu1+esm2 | 4.3.8+dfsg-1ubuntu1+esm2 |
| symfony | symfony | >= 0 < 5.4.4+dfsg-1ubuntu8+esm1 | 5.4.4+dfsg-1ubuntu8+esm1 |
| symfony | symfony | >= 0 < 6.4.5+dfsg-3ubuntu3+esm1 | 6.4.5+dfsg-3ubuntu3+esm1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv8.8HIGH
vendor_ubuntu5.9MEDIUM
vendor_debian3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
symfony vulnerabilities
osv·2025-02-18·CVSS 8.8
CVE-2022-24894 [HIGH] symfony vulnerabilities
symfony vulnerabilities
Soner Sayakci discovered that Symfony incorrectly handled cookie storage in
the web cache. An attacker could possibly use this issue to obtain
sensitive information and access unauthorized resources. (CVE-2022-24894)
Marco Squarcina discovered that Symfony incorrectly handled the storage of
user session information. An attacker could possibly use this issue to
perform a cross-site request forgery (CSRF) attack. (CVE-2022-24895)
Pierre Rudloff discovered that Symfony incorrectly checked HTML input. An
attacker could possibly use this issue to perform cross site scripting.
(CVE-2023-46734)
Vladimir Dusheyko discovered that Symfony incorrectly sanitized special
input with a PHP directive in URL query strings. An attacker could possibly
use this issue to expose sens
OSV
CVE-2024-50345: symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification
osv·2024-11-06·CVSS 6.1
CVE-2024-50345 [MEDIUM] CVE-2024-50345: symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
OSV
Symfony vulnerable to open redirect via browser-sanitized URLs
osv·2024-11-06
CVE-2024-50345 [LOW] Symfony vulnerable to open redirect via browser-sanitized URLs
Symfony vulnerable to open redirect via browser-sanitized URLs
### Description
The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain.
### Resolution
The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/
The patch for this issue is available [here](https://github.com/symfony/symfony/commit/5a9b08e5740af795854b1b639b7d45b9cbfe8819) for branch 5.4.
### Credits
We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.
GHSA
Symfony vulnerable to open redirect via browser-sanitized URLs
ghsa·2024-11-06
CVE-2024-50345 [LOW] CWE-601 Symfony vulnerable to open redirect via browser-sanitized URLs
Symfony vulnerable to open redirect via browser-sanitized URLs
### Description
The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain.
### Resolution
The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/
The patch for this issue is available [here](https://github.com/symfony/symfony/commit/5a9b08e5740af795854b1b639b7d45b9cbfe8819) for branch 5.4.
### Credits
We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.
Ubuntu
Symfony vulnerabilities
vendor_ubuntu·2025-02-18·CVSS 5.9
CVE-2022-24895 [MEDIUM] Symfony vulnerabilities
Title: Symfony vulnerabilities
Summary: Several security issues were fixed in Symfony.
Soner Sayakci discovered that Symfony incorrectly handled cookie storage in
the web cache. An attacker could possibly use this issue to obtain
sensitive information and access unauthorized resources. (CVE-2022-24894)
Marco Squarcina discovered that Symfony incorrectly handled the storage of
user session information. An attacker could possibly use this issue to
perform a cross-site request forgery (CSRF) attack. (CVE-2022-24895)
Pierre Rudloff discovered that Symfony incorrectly checked HTML input. An
attacker could possibly use this issue to perform cross site scripting.
(CVE-2023-46734)
Vladimir Dusheyko discovered that Symfony incorrectly sanitized special
input with a PHP directive in URL query s
Debian
CVE-2024-50345: symfony - symfony/http-foundation is a module for the Symphony PHP framework which defines...
vendor_debian·2024·CVSS 3.1
CVE-2024-50345 [LOW] CVE-2024-50345: symfony - symfony/http-foundation is a module for the Symphony PHP framework which defines...
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Scope: local
bookworm: resolved (fixed in 5.4.23+dfsg-1+deb12u3)
bullseye: resolved (fixed in 4.4.19+dfsg-2+deb11u7)
forky: resolved (fixed in 6.4.14+dfsg-1)
sid: resolved (fixed i
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-06
Published