CVE-2019-10913
Published: 16 May 2019
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
symfony Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| cosmic |
Ignored
(end of life)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Not vulnerable
(3.4.22+dfsg-2)
|
|
| focal |
Not vulnerable
(3.4.22+dfsg-2)
|
|
| groovy |
Not vulnerable
(3.4.22+dfsg-2)
|
|
| hirsute |
Not vulnerable
(3.4.22+dfsg-2)
|
|
| impish |
Not vulnerable
(3.4.22+dfsg-2)
|
|
| jammy |
Not vulnerable
(3.4.22+dfsg-2)
|
|
| kinetic |
Not vulnerable
(3.4.22+dfsg-2)
|
|
| lunar |
Not vulnerable
(3.4.22+dfsg-2)
|
|
| mantic |
Not vulnerable
(3.4.22+dfsg-2)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(3.4.22+dfsg-2)
|
|
| xenial |
Needed
|
|
|
Patches: upstream: https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |