VulnerabilityModified
CVE-2013-4752
The Host header can be manipulated by an attacker when the framework is generating an absolute URL.
MEDIUM 6.1EPSS 2.31%
Does this matter?
Lower severity and a low EPSS score (2.31%). Track it; it rarely justifies an emergency change on its own.
Description
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 2.31% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- sensiolabs/symfony · fedoraproject/fedora
- Source
- cve@mitre.org
References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114450.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114461.htmlThird Party Advisory
- http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-releasedPatch, Vendor Advisory
- http://www.securityfocus.com/bid/61715Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4752Issue Tracking, Patch, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86365Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86366Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86367Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86368Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86369Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86370Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86371Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86372Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86373Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86374Third Party Advisory, VDB Entry
- http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114450.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114461.htmlThird Party Advisory
- http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-releasedPatch, Vendor Advisory
- http://www.securityfocus.com/bid/61715Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4752Issue Tracking, Patch, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86365Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86366Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86367Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86368Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86369Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86370Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86371Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86372Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86373Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86374Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.