CVE-2018-14773 — Acceptance of Extraneous Untrusted Data With Trusted Data in Http-foundation
Severity
6.5MEDIUMNVD
EPSS
16.7%
top 5.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 3
Latest updateMay 13
Description
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these req…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages5 packages
Also affects: Debian Linux 8.0, 9.0
Patches
🔴Vulnerability Details
4📋Vendor Advisories
1Debian▶
CVE-2018-14773: symfony - An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8....↗2018
💬Community
5Bugzilla▶
CVE-2018-14773 php-symfony: Legacy HTTP headers allow users to modify URLs and bypass restrictions↗2018-08-03
Bugzilla▶
CVE-2018-14773 php-symfony4: php-symfony: Legacy HTTP headers allow users to modify URLs and bypass restrictions [fedora-all]↗2018-08-03
Bugzilla▶
CVE-2018-14773 php-symfony: Legacy HTTP headers allow users to modify URLs and bypass restrictions [epel-all]↗2018-08-03
Bugzilla▶
CVE-2018-14773 php-symfony: Legacy HTTP headers allow users to modify URLs and bypass restrictions [fedora-all]↗2018-08-03
Bugzilla▶
CVE-2018-14773 php-symfony3: php-symfony: Legacy HTTP headers allow users to modify URLs and bypass restrictions [fedora-all]↗2018-08-03