CVE-2023-46735

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now doesn't return any user-submitted input in its response.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
symfony	symfony	>= 6.3.0, < 6.3.8

References

https://github.com/symfony/symfony/commit/8128c302430394f639e818a7103b3f6815d8d962Patch
https://github.com/symfony/symfony/security/advisories/GHSA-72x2-5c85-6wmrPatch, Vendor Advisory
https://github.com/symfony/symfony/commit/8128c302430394f639e818a7103b3f6815d8d962Patch
https://github.com/symfony/symfony/security/advisories/GHSA-72x2-5c85-6wmrPatch, Vendor Advisory

Timeline

Published: Nov 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-467366.5EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) CVE-2023-467375.3Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An at CVE-2023-467386.5CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3 CVE-2023-467395.9CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior CVE-2023-4674Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Compu CVE-2023-467409.8CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to genera CVE-2023-467419.8CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users CVE-2023-467426.5CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys CVE-2023-467434.3application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a u CVE-2023-467445.4Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Scripting (XSS) vulnerability en CVE-2023-467457.5LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and oper CVE-2023-467464.3PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side re