GitHub Advisoryadvisory · Packagist

GHSA-wvq5-72qp-grjw Symphony CMS vulnerable to Cross-site Scripting

LOW Published 2022-05-17 Modified 2025-04-12 Official page ↗
Aliases
CVE-2011-4340
Ecosystem
Packagist
Packages
symphonycms/symphony-2
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
Weaknesses
CWE-79
Reviewed
2025-04-12

Affected packages

• Packagist symphonycms/symphony-2: < 2.2.4 → fixed in 2.2.4

Description

Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author privileges to inject arbitrary web script or HTML via (1) the profile parameter to extensions/profiledevkit/content/content.profile.php, as demonstrated via requests to (a) the default URI, (b) about/, or (c) drafts/; or (2) the filter parameter in symphony/lib/core/class.symphony.php, as demonstrated via requests to (d) symphony/publish/comments or (e) symphony/publish/images. NOTE: some of these details are obtained from third party information.

Related

Alias · CVE (1)

  • CVE-2011-4340 Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References