GHSA-x92h-wmg2-6hp7
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
At a glance
- Published
- Updated
- CVE
- CVE-2019-10913
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
Affected packages
| Package | Versions |
|---|---|
| Packagist · symfony/http-foundation | introduced 2.7.0, fixed 2.7.51 |
| Packagist · symfony/http-foundation | introduced 2.8.0, fixed 2.8.50 |
| Packagist · symfony/http-foundation | introduced 3.0.0, fixed 3.4.26 |
| Packagist · symfony/http-foundation | introduced 4.0.0, fixed 4.1.12 |
| Packagist · symfony/http-foundation | introduced 4.2.0, fixed 4.2.7 |
| Packagist · symfony/symfony | introduced 2.7.0, fixed 2.7.51 |
| Packagist · symfony/symfony | introduced 2.8.0, fixed 2.8.50 |
| Packagist · symfony/symfony | introduced 3.0.0, fixed 3.4.26 |
| Packagist · symfony/symfony | introduced 4.0.0, fixed 4.1.12 |
| Packagist · symfony/symfony | introduced 4.2.0, fixed 4.2.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10913 ADVISORY
- https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-10913.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10913.yaml WEB
- https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides WEB
- https://symfony.com/cve-2019-10913 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |