{"id":"GHSA-72x2-5c85-6wmr","aliases":["BIT-symfony-2023-46735","CVE-2023-46735"],"title":"Symfony potential Cross-site Scripting in WebhookController","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Description\n\nThe error message in WebhookController returns unescaped user-submitted input.\n\n### Resolution\n\nWebhookController now doesn't return any user-submitted input in its response.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/8128c302430394f639e818a7103b3f6815d8d962) for branch 6.3.\n\n### Credits\n\nWe would like to thank Maxime Aknin for reporting the issue and to Nicolas Grekas for providing the fix.","severity":"medium","score":6.1,"published":"2023-11-12T15:53:29.000Z","modified":"2026-09-10T03:49:58.823Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"symfony/webhook","sources":[{"name":"OSV · GHSA-72x2-5c85-6wmr","url":"https://osv.dev/vulnerability/GHSA-72x2-5c85-6wmr"}],"ranges":[{"events":[{"introduced":"6.3.0"},{"fixed":"6.3.8"}],"type":"ECOSYSTEM"}],"versions":["v6.3.0"],"fixed":["6.3.8"]},{"ecosystem":"Packagist","name":"symfony/symfony","sources":[{"name":"OSV · GHSA-72x2-5c85-6wmr","url":"https://osv.dev/vulnerability/GHSA-72x2-5c85-6wmr"}],"ranges":[{"events":[{"introduced":"6.3.0"},{"fixed":"6.3.8"}],"type":"ECOSYSTEM"}],"versions":["v6.3.0","v6.3.1","v6.3.2","v6.3.3","v6.3.4","v6.3.5","v6.3.6","v6.3.7"],"fixed":["6.3.8"]}],"sourceAffected":[],"references":["https://github.com/symfony/symfony/security/advisories/GHSA-72x2-5c85-6wmr","https://nvd.nist.gov/vuln/detail/CVE-2023-46735","https://github.com/symfony/symfony/commit/8128c302430394f639e818a7103b3f6815d8d962","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2023-46735.yaml","https://github.com/symfony/symfony","https://symfony.com/cve-2023-46735"],"sources":[{"name":"OSV","id":"GHSA-72x2-5c85-6wmr","modified":"2026-09-10T03:49:58.823261839Z","url":"https://osv.dev/vulnerability/GHSA-72x2-5c85-6wmr"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":5.3}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:50:31.598Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}