CVE-2011-4340: Symphony CMS Cross-site Scripting Vulnerability
Summary
CVE-2011-4340: Symphony CMS vulnerable to Cross-site Scripting. Affects symphonycms/symphony-2 versions < 2.2.4. Fixed in 2.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symphony CMS is an open-source content management system designed for developers to create and manage websites with ease. It offers a flexible framework for building custom content types and managing user permissions. However, versions prior to 2.2.4 are susceptible to multiple cross-site scripting (XSS) vulnerabilities, which can allow authenticated users with Author privileges to inject malicious scripts into web pages.
Vulnerability Detail
The vulnerability arises from inadequate input validation in Symphony CMS, specifically in the handling of user profile parameters and filter parameters. This allows remote authenticated users to inject arbitrary web scripts or HTML into the application. The affected endpoints include profiledevkit content management and comment/image publishing features. If exploited, this could lead to unauthorized actions on behalf of users, data theft, or defacement of the website.
How To Fix
Minimum fixed version
2.2.4
This is the first release that contains the fix.
composer require symphonycms/symphony-2:2.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected features for users with Author privileges until the update is applied. This can be done by modifying user roles and permissions in the Symphony CMS admin panel.
Conclusion
The CVE-2011-4340 vulnerability in Symphony CMS poses a significant risk to applications using versions prior to 2.2.4. It is crucial to update to the latest version to protect against potential XSS attacks. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for symphonycms/symphony-2 →
FAQ
The vulnerability allows authenticated users to inject malicious scripts into the application, potentially compromising user data and site integrity.
Versions 2.2.3 and possibly earlier versions are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and damage to the website's reputation.
Yes, you can restrict access to the affected features for users with Author privileges as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for symphonycms/symphony-2.
