Symfony Host Header Injection
An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-14774US | high7.2 | — | ||
An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/symfony/symfonyPACKAGE
- https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4aWEB
- https://github.com/symfony/symfony/commit/7f912bbb78377c2ea331b3da28363435fbd91337WEB
- https://github.com/symfony/symfony/commit/96504fb8c9f91204727d2930eb837473ce154956WEB
- https://github.com/symfony/symfony/commit/974240e178bb01d734bf1df1ad5c3beba6a2f982WEB
- https://github.com/symfony/symfony/commit/9cfcaba0bf71f87683510b5f47ebaac5f5d6a5baWEB
- https://github.com/symfony/symfony/commit/bcf5897bb1a99d4acae8bf7b73e81bfdeaac0922WEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-14774ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan