Description
In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.
Scores
CVSS v3
2.6
EPSS
0.0037
EPSS Percentile
59.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Details
CWE
CWE-20
CWE-435
Status
published
Products (3)
sensiolabs/symfony
4.4.0 - 4.4.7
symfony/http-foundation
4.4.0 - 4.4.7Packagist
symfony/symfony
4.4.0 - 4.4.7Packagist
Published
Mar 30, 2020
Tracked Since
Feb 18, 2026