CVE-2026-45754— Symfony 授权问题漏洞
Affected Version Matrix 8
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| symfony | lox24-notifier | >= 7.1.0-BETA1, < 7.4.12 | affected |
>= 8.0.0-BETA1, < 8.0.12 | affected | ||
| symfony | mailjet-mailer | >= 6.4.0, < 6.4.40 | affected |
>= 7.0.0-BETA1, < 7.4.12 | affected | ||
>= 8.0.0-BETA1, < 8.0.12 | affected | ||
| symfony | symfony | >= 6.4.0, < 6.4.40 | affected |
>= 7.0.0-BETA1, < 7.4.12 | affected | ||
>= 8.0.0-BETA1, < 8.0.12 | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-45754の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
ソース: NVD (National Vulnerability Database)
脆弱性説明
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
认证机制不恰当
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Symfony 授权问题漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Symfony是Symfony组织开源的一个用于 Web 和控制台应用程序的 PHP 框架以及一组可重用的 PHP 组件。 Symfony存在授权问题漏洞，该漏洞源于Mailjet mailer bridge和LOX24 notifier bridge的webhook解析器接收了配置的webhook密钥但未进行验证，可能导致未经身份验证的POST请求注入伪造的Mailjet和LOX24事件有效载荷。以下版本受到影响：6.4.40之前版本、7.4.12之前版本和8.0.12之前版本。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| symfony | symfony | >= 6.4.0, < 6.4.40 | - | |
| symfony | lox24-notifier | >= 7.1.0-BETA1, < 7.4.12 | - | |
| symfony | mailjet-mailer | >= 6.4.0, < 6.4.40 | - |
II. CVE-2026-45754の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-45754のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-45754 补丁与修复 (4)
CVE-2026-45754 厂商安全公告 (1)
CVE-2026-45754 厂商页面 (1)
Same Patch Batch · symfony · 2026-07-14 · 30 CVEs total
| CVE-2026-45070 | Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names | |
| CVE-2026-46644 | symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only | |
| CVE-2026-48761 | Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, | |
| CVE-2026-48736 | Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-c | |
| CVE-2026-48747 | Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signatu | |
| CVE-2026-48760 | Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks an | |
| CVE-2026-48489 | Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access t | |
| CVE-2026-48784 | Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Gener | |
| CVE-2026-47212 | Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauth | |
| CVE-2026-45068 | Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address | |
| CVE-2026-45071 | Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = | |
| CVE-2026-47767 | Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/AP | |
| CVE-2026-45075 | Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureVali | |
| CVE-2026-45304 | Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansio | |
| CVE-2026-45063 | Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator | |
| CVE-2026-45756 | Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Wi | |
| CVE-2026-45133 | Symfony: [Yaml] Harden the parser when handling untrusted input | |
| CVE-2026-45069 | Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | |
| CVE-2026-45753 | Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascr | |
| CVE-2026-45072 | Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File R |
Showing 20 of 30 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: symfony
- CVE-2026-48761
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attr - CVE-2026-48747
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algor - CVE-2026-48489
Symfony: Security Firewall Bypass via failure_forward Subreq - CVE-2026-48760
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: - CVE-2026-48736
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Form
同じベンダー: symfony
- CVE-2026-49215
Symfony UX: CSRF Protection Bypass in symfony/ux-live-compon - CVE-2026-49216
Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJA - CVE-2026-49211
Symfony UX: Information exposure via unescaped LIKE wildcard - CVE-2026-49208
Symfony UX: Format-less date LiveProps parsed with the permi - CVE-2026-49210
Symfony UX: XSS in symfony/ux-live-component via attacker-co
同じ弱点: CWE-287
- CVE-2024-58363
SurrealDB before 1.5.4 Authentication Bypass via Database Sw - CVE-2026-47865
VMware Avi Load Balancer Authentication Bypass Vulnerability - CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key - CVE-2026-55445
Qinglong: Incomplete fix for CVE-2026-3965: Improper Authent - CVE-2026-55652
Wekan: Header-login IP allowlist bypass via X-Forwarded-For
V. CVE-2026-45754へのコメント
まだコメントはありません