CVE-2024-50345

{"id": "CVE-2024-50345", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "published": "2024-11-06T21:15:06.383", "references": [{"url": "https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp", "source": "security-advisories@github.com"}, {"url": "https://url.spec.whatwg.org", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "symfony/http-foundation es un m\u00f3dulo para el framework PHP Symphony que define una capa orientada a objetos para la especificaci\u00f3n HTTP. La clase `Request` no analiza las URI con caracteres especiales de la misma forma que lo hacen los navegadores. Como resultado, un atacante puede enga\u00f1ar a un validador que se basa en la clase `Request` para redirigir a los usuarios a otro dominio. Los m\u00e9todos `Request::create` ahora afirman que la URI no contiene caracteres no v\u00e1lidos seg\u00fan lo definido por https://url.spec.whatwg.org/. Este problema ha sido corregido en las versiones 5.4.46, 6.4.14 y 7.1.7. Se recomienda a los usuarios que actualicen. No existen workarounds para esta vulnerabilidad."}], "lastModified": "2024-11-08T19:01:25.633", "sourceIdentifier": "security-advisories@github.com"}