MediumGHSA-22pv-7v9j-hqxpCVE-2013-4752
Symfony Host Header Injection vulnerability in the HttpFoundation component
Published 5 May 2022 · Updated 16 Mar 2024
Affected packages
symfony/symfonyComposer
- Affected
- >=2.0.0 <2.0.24
- Fixed in
- 2.0.24
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^2.0.24symfony/symfonyComposer
- Affected
- >=2.1.0 <2.1.12
- Fixed in
- 2.1.12
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^2.1.12symfony/symfonyComposer
- Affected
- >=2.2.0 <2.2.5
- Fixed in
- 2.2.5
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^2.2.5symfony/symfonyComposer
- Affected
- >=2.3.0 <2.3.3
- Fixed in
- 2.3.3
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^2.3.3symfony/http-foundationComposer
- Affected
- >=2.0.0 <2.0.24
- Fixed in
- 2.0.24
Update to the fixed version for your release line, for example:
composer require symfony/http-foundation:^2.0.24symfony/http-foundationComposer
- Affected
- >=2.1.0 <2.1.12
- Fixed in
- 2.1.12
Update to the fixed version for your release line, for example:
composer require symfony/http-foundation:^2.1.12symfony/http-foundationComposer
- Affected
- >=2.2.0 <2.2.5
- Fixed in
- 2.2.5
Update to the fixed version for your release line, for example:
composer require symfony/http-foundation:^2.2.5symfony/http-foundationComposer
- Affected
- >=2.3.0 <2.3.3
- Fixed in
- 2.3.3
Update to the fixed version for your release line, for example:
composer require symfony/http-foundation:^2.3.3Details
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.
Is GHSA-22pv-7v9j-hqxp in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/symfony, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2013-4752
- Linkweb.archive.org/web/20130901060826/http://www.securityfocus.com/bid/61715
- Linksymfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released
- Packagegithub.com/symfony/symfony
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-4752.yaml
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2013-4752.yaml
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/86374
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/86373
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/86372
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/86371
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/86370
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/86369
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/86368
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/86367
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/86366
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/86365
- Linkbugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4752
- Linklists.fedoraproject.org/pipermail/package-announce/2013-August/114450.html
- Linklists.fedoraproject.org/pipermail/package-announce/2013-August/114461.html
- Linksymfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.