auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped
Priority HIGH 71CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because `%source_label%` in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00446 39th percentileScored 2026-11-07
Fix Fixed auditor-bundle (DamienHarper): 5.2.6damienharper/auditor-bundle (Packagist): 5.2.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| DamienHarper | auditor-bundle | before 5.2.6 | 5.2.6 | Patch available | CNA |
| — | damienharper/auditor-bundle (Packagist) | before 5.2.6 | 5.2.6 | Patch available | GHSA-78vg-7v27-hj67 |
- auditor-bundle VendorDamienHarper Affected before 5.2.6 Fixed in 5.2.6 Patch available CNA
- damienharper/auditor-bundle (Packagist) Vendor— Affected before 5.2.6 Fixed in 5.2.6 Patch available GHSA-78vg-7v27-hj67
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:damienharper:auditor-bundle:*:*:*:*:*:*:*:* | 5.0.0 to before 5.2.6 | Vulnerable | DamienHarper |
- cpe:2.3:a:damienharper:auditor-bundle:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.2.6 Vulnerable ·DamienHarper
Remediation
- Fix · CNA auditor-bundle (DamienHarper) Fixed in 5.2.6
- Fix · GHSA-78vg-7v27-hj67 damienharper/auditor-bundle (Packagist) Fixed in 5.2.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45592
- 2026-10-03 Alias added: GHSA-78vg-7v27-hj67
References
Patch 2
Advisory 2
Sources
- CVE-2024-45592 · CVE Program
- CVE-2024-45592 · NVD
- FIRST EPSS
- GHSA-78vg-7v27-hj67 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences