GHSA-rrvc-c7xg-7cf3
TokenController formName not sanitized in hidden input
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | sulu/form-bundle | >= 2.0.0, < 2.5.3 | 2.5.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
TokenController get parameter formName not sanitized in returned input field leads to XSS.
_What kind of vulnerability is it? Who is impacted?_
### Patches
_Has the problem been patched? What versions should users upgrade to?_
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Create a custom Symfony Request listener which checks for the get value of `form` for the TokenController and if not valid stop the request dispatching and return a error status code.
### References
_Are there any links users can visit to find out more?_
References
External links from the advisory. They lead to third-party sites.