CVE-2024-45592: 
PHP vulnerability analysis and mitigation

auditor-bundle (formerly known as DoctrineAuditBundle), a library that integrates auditor functionality into Symfony 3.4+ applications, was found to contain a cross-site scripting vulnerability (CVE-2024-45592). Prior to version 5.2.6, an unescaped entity property enabled JavaScript injection through the %source_label% parameter in a twig macro that was not properly escaped, allowing script tags to be inserted and executed. The vulnerability was discovered on September 10, 2024, and has been fixed in versions 6.0.0 and 5.2.6 (GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 severity ratings differ between assessments, with GitHub scoring it as 8.2 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) and NVD scoring it as 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability specifically exists in the twig macro where the %source_label% parameter is not properly escaped, enabling persistent XSS attacks (GitHub Advisory).

The vulnerability allows for persistent cross-site scripting attacks where malicious JavaScript can be injected and executed in the context of other users' browsers. This could potentially lead to unauthorized access to user data, session hijacking, or other client-side attacks (GitHub Advisory).

The vulnerability has been fixed in versions 5.2.6 and 6.0.0 by properly escaping the output in the affected twig macro. Users are advised to upgrade to these patched versions (GitHub Advisory).