CVE-2019-10913

CRITICAL

Symfony 2.7.0-2.7.50, 2.8.0-2.8.49, 3.0.0-3.4.25, 4.0.0-4.1.11, 4.2.0-4.2.6 - XSS via HTTP Method Override

Title source: llm
STIX 2.1

Description

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0185
EPSS Percentile 76.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-79 CWE-89
Status published
Products (3)
sensiolabs/symfony 2.7.0 - 2.7.51
symfony/http-foundation 2.7.0 - 2.7.51Packagist
symfony/symfony 2.7.0 - 2.7.51Packagist
Published May 16, 2019
Tracked Since Feb 18, 2026