- Vulnerability/
- GHSA-p9fg-j6ww-953m
GHSA-p9fg-j6ww-953m
First published: Wed May 15 2024(Updated: )
Starting with FOSRestBundle 1.2 we [switched](https://github.com/FriendsOfSymfony/FOSRestBundle/pull/642/files#diff-431bc57ca9ca16332c0cff43ad45263cR37) to using [willdurand/jsonp-callback-validator](https://github.com/willdurand/JsonpCallbackValidator) for validation of JSONP callbacks. However [the change was implemented](https://github.com/FriendsOfSymfony/FOSRestBundle/pull/665) incorrectly validating the callback query param name, rather than its value. Anyone using the JSONP handler (which is off by default) together with FOSRestBundle 1.2.0 or 1.2.1 should update to FOSRestBundle [1.2.2](https://github.com/FriendsOfSymfony/FOSRestBundle/releases/tag/1.2.2).
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/friendsofsymfony/rest-bundle | >=1.2.0<1.2.2 | 1.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/FriendsOfSymfony/FOSRestBundle/commit/3dd7d40068360c23366fb4884c5d194c769ec2c1
- https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/rest-bundle/2014-01-22-1.yaml
- https://symfony.com/blog/fosrestbundle-security-issue-with-jsonp-handler
- https://github.com/advisories/GHSA-p9fg-j6ww-953m (Advisory)
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-p9fg-j6ww-953m
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/severity
- agent/type
- agent/softwarecombine
- agent/event
- agent/description
- agent/first-publish-date
- agent/tags
- collector/github-advisory
- package-manager/composer