CVE-2013-4752 Symfony Host Header Injection vulnerability in the HttpFoundation component
MediumCVSS 6.1
EPSS 2.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony/symfony(Packagist) | >= 2.0.0, < 2.0.24 | 2.0.24 |
| symfony/symfony(Packagist) | = 2.0.4 | No fix listed |
| symfony/symfony(Packagist) | = 2.0.5 | No fix listed |
| symfony/symfony(Packagist) | = 2.0.6 | No fix listed |
| symfony/symfony(Packagist) | = 2.0.7 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.10 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.11 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.12 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.13 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.14 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.15 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.16 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.17 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.18 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.19 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.20 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.21 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.22 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.23 | No fix listed |
| symfony/symfony(Packagist) | = v2.0.9 | No fix listed |
| symfony/symfony(Packagist) | >= 2.1.0, < 2.1.12 | 2.1.12 |
| symfony/symfony(Packagist) | = v2.1.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.1.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.1.10 | No fix listed |
| symfony/symfony(Packagist) | = v2.1.11 | No fix listed |
Show 66 more
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony/symfony(Packagist) | = v2.1.2 | No fix listed |
| symfony/symfony(Packagist) | = v2.1.3 | No fix listed |
| symfony/symfony(Packagist) | = v2.1.4 | No fix listed |
| symfony/symfony(Packagist) | = v2.1.5 | No fix listed |
| symfony/symfony(Packagist) | = v2.1.6 | No fix listed |
| symfony/symfony(Packagist) | = v2.1.7 | No fix listed |
| symfony/symfony(Packagist) | = v2.1.8 | No fix listed |
| symfony/symfony(Packagist) | = v2.1.9 | No fix listed |
| symfony/symfony(Packagist) | >= 2.2.0, < 2.2.5 | 2.2.5 |
| symfony/symfony(Packagist) | = v2.2.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.2.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.2.2 | No fix listed |
| symfony/symfony(Packagist) | = v2.2.3 | No fix listed |
| symfony/symfony(Packagist) | = v2.2.4 | No fix listed |
| symfony/symfony(Packagist) | >= 2.3.0, < 2.3.3 | 2.3.3 |
| symfony/symfony(Packagist) | = v2.3.0 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.1 | No fix listed |
| symfony/symfony(Packagist) | = v2.3.2 | No fix listed |
| symfony/http-foundation(Packagist) | >= 2.0.0, < 2.0.24 | 2.0.24 |
| symfony/http-foundation(Packagist) | = 2.0.4 | No fix listed |
| symfony/http-foundation(Packagist) | = 2.0.5 | No fix listed |
| symfony/http-foundation(Packagist) | = 2.0.6 | No fix listed |
| symfony/http-foundation(Packagist) | = 2.0.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.10 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.12 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.13 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.14 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.15 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.16 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.17 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.18 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.19 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.20 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.21 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.22 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.23 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.0.9 | No fix listed |
| symfony/http-foundation(Packagist) | >= 2.1.0, < 2.1.12 | 2.1.12 |
| symfony/http-foundation(Packagist) | = v2.1.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.10 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.11 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.2 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.4 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.5 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.6 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.7 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.8 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.1.9 | No fix listed |
| symfony/http-foundation(Packagist) | >= 2.2.0, < 2.2.5 | 2.2.5 |
| symfony/http-foundation(Packagist) | = v2.2.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.2.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.2.2 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.2.3 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.2.4 | No fix listed |
| symfony/http-foundation(Packagist) | >= 2.3.0, < 2.3.3 | 2.3.3 |
| symfony/http-foundation(Packagist) | = v2.3.0 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.3.1 | No fix listed |
| symfony/http-foundation(Packagist) | = v2.3.2 | No fix listed |
| sensiolabs symfony | >= 2.0.0, < 2.0.24 | 2.0.24 |
| sensiolabs symfony | >= 2.1.0, < 2.1.12 | 2.1.12 |
| sensiolabs symfony | >= 2.2.0, < 2.2.5 | 2.2.5 |
| sensiolabs symfony | >= 2.3.0, < 2.3.3 | 2.3.3 |
| fedoraproject fedora | = 18 | No fix listed |
| fedoraproject fedora | = 19 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- web.archive.org
- symfony.com
- github.com product
- github.com exploit
- github.com exploit
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- lists.fedoraproject.org third-party-advisory
- lists.fedoraproject.org third-party-advisory
- symfony.com patch vendor-advisory
- github.com
- www.securityfocus.com third-party-advisory vdb-entry