p PatchFirst

CVE-2024-45592

CVE-2024-45592 · auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

This page contains facts from public vulnerability sources. Check the original advisory before updating.

auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because `%source_label%` in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.

CVSS 8.2 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • auditor-bundle

    Versions
    • < 5.2.6: Affected

    No fix published

  • damienharper/auditor-bundle Packagist

    Versions
    • 1.0.0
    • 1.0.1
    • 1.0.10
    • 1.0.11
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    • 1.1.0
    • 1.2.0
    • 1.2.1
    • 1.2.2
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.4.0
    • 2.5.0
    • 3.0.0
    • 3.1.0
    • 3.2.0
    • 3.2.1
    • 3.2.2
    • 3.2.3
    • 3.3.0
    • 3.3.1
    • 3.3.2
    • 3.4.0
    • 3.4.1
    • 3.4.2
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.0.3
    • 4.0.4
    • 4.1.0
    • 4.2.0
    • 5.0.0
    • 5.0.1
    • 5.0.2
    • 5.0.3
    • 5.1.0
    • 5.1.1
    • 5.2.0
    • 5.2.1
    • 5.2.2
    • 5.2.3
    • 5.2.4
    • 5.2.5
    Affected ranges
    • ECOSYSTEM: < 5.2.6

    Update to 5.2.6

Original sources

Check your server →