Skip to main content

Improper Input Validation

CVE-2024-50343

Low
3.1/10

Summary

The symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a "Validator" configured with a regular expression using the "$" metacharacters, with an input ending with "\n". Symfony now uses the "D" regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue affects Symfony versions through 5.4.42, 6.0.0-BETA1 through 6.4.10, and 7.0.0-BETA1 through 7.1.3.

  • HIGH
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published