CVE-2023-41336
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-41336
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-41336.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-41336
- Aliases
- Published
- 2023-09-11T19:21:48Z
- Modified
- 2025-10-30T20:22:34.002054Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
- Details
-
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an
EntityTypethat is not part of the valid choices. The problem has been fixed insymfony/ux-autocompleteversion 2.11.2. - Database specific
{ "cwe_ids": [ "CWE-20" ] }- References
-
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2023-41336.yaml
- https://github.com/symfony/ux-autocomplete/commit/fabcb2eee14b9e84a45b276711853a560b5d770c
- https://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79x
- https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax