Moderate severityNVD Advisory· Published Nov 10, 2023· Updated Sep 3, 2024
Symfony potential Cross-site Scripting in WebhookController
CVE-2023-46735
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in WebhookController returns unescaped user-submitted input. As of version 6.3.8, WebhookController now doesn't return any user-submitted input in its response.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
symfony/webhookPackagist | >= 6.3.0, < 6.3.8 | 6.3.8 |
symfony/symfonyPackagist | >= 6.3.0, < 6.3.8 | 6.3.8 |
Affected products
1- Range: >= 6.3.0, < 6.3.8
Patches
18128c3024303[Webhook] Remove user-submitted type from HTTP response
1 file changed · +1 −1
src/Symfony/Component/Webhook/Controller/WebhookController.php+1 −1 modified@@ -38,7 +38,7 @@ public function __construct( public function handle(string $type, Request $request): Response { if (!isset($this->parsers[$type])) { - return new Response(sprintf('No parser found for webhook of type "%s".', $type), 404); + return new Response('No webhook parser found for the type given in the URL.', 404, ['Content-Type' => 'text/plain']); } /** @var RequestParserInterface $parser */ $parser = $this->parsers[$type]['parser'];
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/advisories/GHSA-72x2-5c85-6wmrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-46735ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2023-46735.yamlghsaWEB
- github.com/symfony/symfony/commit/8128c302430394f639e818a7103b3f6815d8d962ghsax_refsource_MISCWEB
- github.com/symfony/symfony/security/advisories/GHSA-72x2-5c85-6wmrghsax_refsource_CONFIRMWEB
- symfony.com/cve-2023-46735ghsaWEB
News mentions
0No linked articles in our index yet.