This security advisory is about a vulnerability in Symfony where validation messages are not escaped, which can lead to XSS when user input is included. There is no known exploit against Ibexa software, but we recommend applying the fix.
The issue is fixed in symfony/framework-bundle 2.8.50, 3.4.26, 4.1.12, and 4.2.7.
The Ibexa package ibexa/templated-uri-bundle requires these versions since v2.1.0.1 (eZ Platform v2.5), and v3.3.2.1 (Ibexa DXP v3.3 and v4).
This security advisory is about a vulnerability in Symfony where validation messages are not escaped, which can lead to XSS when user input is included. There is no known exploit against Ibexa software, but we recommend applying the fix.
The issue is fixed in symfony/framework-bundle 2.8.50, 3.4.26, 4.1.12, and 4.2.7.
The Ibexa package ibexa/templated-uri-bundle requires these versions since v2.1.0.1 (eZ Platform v2.5), and v3.3.2.1 (Ibexa DXP v3.3 and v4).