Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-10913

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.

Published

2019-05-16T22:29:00.673

Last Modified

2024-11-21T04:20:08.240

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-79
    CWE-89
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sensiolabs symfony < 2.7.51 Yes
Application sensiolabs symfony < 2.8.50 Yes
Application sensiolabs symfony < 3.4.26 Yes
Application sensiolabs symfony < 4.1.12 Yes
Application sensiolabs symfony < 4.2.7 Yes
References