CVE-2024-50345

LOW

3.1

Beschreibung

symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE Details

CVSS v3.1 Bewertung3.1

SchweregradLOW

CVSS VektorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

AngriffsvektorNETWORK

KomplexitatHIGH

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht11/6/2024

Zuletzt geandert11/3/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

sensiolabs:symfony

Schwachen (CWE)

CWE-601

Referenzen

https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp(security-advisories@github.com)

https://url.spec.whatwg.org(security-advisories@github.com)

https://lists.debian.org/debian-lts-announce/2025/05/msg00051.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.