CVE-2024-45592
High
Description
auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because `%source_label%` in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.
SeverityHigh
CVSS8.2
Exploit probability—
ProductDamienharper Auditor-bundle
PublishedSep 10, 2024
First seenSep 10, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- damienharper auditor-bundle5.2.6 or later
- damienharper/auditor-bundle5.2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| damienharper auditor-bundle | 5.0.0 ≤ v < 5.2.6 | 5.2.6 |
| damienharper/auditor-bundlePackagist | v < 5.2.6 | 5.2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.