{"action":"Upgrade nzo/url-encryptor-bundle to 4.3.2 or later.","affected":[{"fixed":"5.0.1","introduced":"5.0.0"},{"fixed":"4.3.2","introduced":"4.0.0"}],"component":"nzo/url-encryptor-bundle","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["5.0.1","4.3.2"],"ghsa_id":"GHSA-r2r8-36pq-27cm","id":"tcs_01M5KF7RCGJ0Y1HWZWAV8TXY4K","modified_at":"2024-12-02T05:51:28.774651Z","published_at":"2024-05-17T23:06:52Z","references":["https://osv.dev/vulnerability/GHSA-r2r8-36pq-27cm","https://github.com/nayzo/NzoUrlEncryptorBundle/commit/ba3af1a9bcf3bedcc0ed5948979f482e2134da1a","https://github.com/nayzo/NzoUrlEncryptorBundle/commit/bd8232501c12c9df1bc45b1970870ef665218581","https://github.com/FriendsOfPHP/security-advisories/blob/master/nzo/url-encryptor-bundle/2020-05-03.yaml","https://github.com/nayzo/NzoUrlEncryptorBundle"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-r2r8-36pq-27cm","url":"https://osv.dev/vulnerability/GHSA-r2r8-36pq-27cm"}],"summary":"nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values"}