Vulnerability · Published Nov 6, 2024 · Assigned by GitHub_M
CVE-2024-50345Open redirect via browser-sanitized URLs in symfony/http-foundation
Low 3.1
In plain English
A low-severity open redirect in symfony from symfony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | symfony | 5.4.23+dfsg-1+deb12u3 | DSA-5809-1 |
| Debian:12 | symfony | 5.4.23+dfsg-1+deb12u3 | DEBIAN-CVE-2024-50345 |
| Debian:13 | symfony | 6.4.14+dfsg-1 | DEBIAN-CVE-2024-50345 |
| Debian:14 | symfony | 6.4.14+dfsg-1 | DEBIAN-CVE-2024-50345 |
| Packagist | symfony/http-foundation | 7.1.7 | GHSA-mrqx-rp3w-jpjp |
| Packagist | symfony/http-foundation | 6.4.14 | GHSA-mrqx-rp3w-jpjp |
| Packagist | symfony/http-foundation | 5.4.46 | GHSA-mrqx-rp3w-jpjp |
| Ubuntu:25.10 | symfony | no fix listed | UBUNTU-CVE-2024-50345 |
| Ubuntu:26.04:LTS | symfony | no fix listed | UBUNTU-CVE-2024-50345 |
Affected products (as reported)
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N