CVE-2018-14774 Information

Description

An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48 2.8.0 through 2.8.43 3.3.0 through 3.3.17 3.4.0 through 3.4.13 4.0.0 through 4.0.13 and 4.1.0 through 4.1.2. When using HttpCache the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden leading to potential host header injection.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Reference

https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

7.2