CVE-2023-41336
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-41336
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-41336.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-41336
- Aliases
- Published
- 2023-09-11T20:15:10Z
- Modified
- 2024-10-12T11:04:36.383194Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an
EntityTypethat is not part of the valid choices. The problem has been fixed insymfony/ux-autocompleteversion 2.11.2. - References
-
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2023-41336.yaml
- https://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79x
- https://github.com/symfony/ux-autocomplete/commit/fabcb2eee14b9e84a45b276711853a560b5d770c
- https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax