CVE-2024-45592
auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped
auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped
auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.
- Record
CVE-2024-45592- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-2745
auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.
- Record
EUVD-2024-2745- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-78vg-7v27-hj67
auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped
Summary
Unescaped entity property enables Javascript injection.
Details
I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.
PoC
- clone example project https://github.com/DamienHarper/auditor-bundle-demo
- create author with FullName <script>alert()</script>
- delete author
- view audit of authors
- alert is displayed
Impact
persistent XSS. JS can be injected and executed.
- Record
GHSA-78vg-7v27-hj67- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.
- Record
CVE-2024-45592- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped
auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.
- Record
CVE-2024-45592- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-78vg-7v27-hj67
auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped
Summary
Unescaped entity property enables Javascript injection.
Details
I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.
PoC
- clone example project https://github.com/DamienHarper/auditor-bundle-demo
- create author with FullName <script>alert()</script>
- delete author
- view audit of authors
- alert is displayed
Impact
persistent XSS. JS can be injected and executed.
- Record
GHSA-78vg-7v27-hj67- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
damienharper/auditor-bundlePackagist | before 5.2.6 | 5.2.6 |
damienharper/auditor-bundlePackagist | before 5.2.6, plus listed versions 1.0.01.0.11.0.101.0.111.0.2 Show 45 moreShow less1.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.2.01.2.11.2.21.3.01.4.01.5.01.5.11.6.02.0.02.1.02.2.02.3.02.3.12.3.22.4.02.5.03.0.03.1.03.2.03.2.13.2.23.2.33.3.03.3.13.3.23.4.03.4.13.4.24.0.04.0.14.0.24.0.34.0.44.1.04.2.05.0.05.0.1 | 5.2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45592 is a high vulnerability (CVSS 8.2) in Damienharper Auditor-bundle, published September 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in damienharper/auditor-bundle 5.2.6.
References
github.com/DamienHarper/auditor-bundle/security/advisories/GHSA-78vg-7v27-hj67
nvd.nist.gov/vuln/detail/CVE-2024-45592
Left out here: 10 versions. The JSON record has them.