GHSA-22pv-7v9j-hqxp

Suggest an improvement
Source
https://github.com/advisories/GHSA-22pv-7v9j-hqxp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-22pv-7v9j-hqxp/GHSA-22pv-7v9j-hqxp.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-22pv-7v9j-hqxp
Aliases
  • CVE-2013-4752
Published
2022-05-05T00:29:17Z
Modified
2024-03-16T05:16:26.239033Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Symfony Host Header Injection vulnerability in the HttpFoundation component
Details

Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.

Database specific
{
    "nvd_published_at": "2020-01-02T17:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-17T22:51:04Z"
}
References

Affected packages

Packagist / symfony/symfony

Package

Name
symfony/symfony
Purl
pkg:composer/symfony/symfony

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.0.24

Affected versions

2.*

2.0.4
2.0.5
2.0.6
2.0.7

v2.*

v2.0.9
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.18
v2.0.19
v2.0.20
v2.0.21
v2.0.22
v2.0.23

Packagist / symfony/symfony

Package

Name
symfony/symfony
Purl
pkg:composer/symfony/symfony

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1.0
Fixed
2.1.12

Affected versions

v2.*

v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.1.10
v2.1.11

Packagist / symfony/symfony

Package

Name
symfony/symfony
Purl
pkg:composer/symfony/symfony

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.2.0
Fixed
2.2.5

Affected versions

v2.*

v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4

Packagist / symfony/symfony

Package

Name
symfony/symfony
Purl
pkg:composer/symfony/symfony

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.3.0
Fixed
2.3.3

Affected versions

v2.*

v2.3.0
v2.3.1
v2.3.2

Packagist / symfony/http-foundation

Package

Name
symfony/http-foundation
Purl
pkg:composer/symfony/http-foundation

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.0.24

Affected versions

2.*

2.0.4
2.0.5
2.0.6
2.0.7

v2.*

v2.0.9
v2.0.10
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.18
v2.0.19
v2.0.20
v2.0.21
v2.0.22
v2.0.23

Packagist / symfony/http-foundation

Package

Name
symfony/http-foundation
Purl
pkg:composer/symfony/http-foundation

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1.0
Fixed
2.1.12

Affected versions

v2.*

v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.1.10
v2.1.11

Packagist / symfony/http-foundation

Package

Name
symfony/http-foundation
Purl
pkg:composer/symfony/http-foundation

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.2.0
Fixed
2.2.5

Affected versions

v2.*

v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4

Packagist / symfony/http-foundation

Package

Name
symfony/http-foundation
Purl
pkg:composer/symfony/http-foundation

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.3.0
Fixed
2.3.3

Affected versions

v2.*

v2.3.0
v2.3.1
v2.3.2