p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости symfony/http-foundation

За последние 30 дней в symfony/http-foundation опубликовано уязвимостей: 0; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 14

  1. CVE-2026-48736

    Средний · CVSS 6.9EPSS 0,57%Есть исправление

    Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 6.4.41
    • Обновитесь до 7.4.13
    • Обновитесь до 8.0.13
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. CVE-2025-64500

    Высокий · CVSS 7.3EPSS 1,41%Публичный эксплойтЕсть исправление

    Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 5.4.50
    • Обновитесь до 6.4.29
    • Обновитесь до 7.3.7
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. CVE-2024-50345

    Низкий · CVSS 3.1EPSS 0,59%Есть исправление

    Open redirect via browser-sanitized URLs in symfony/http-foundation

    symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 5.4.46
    • Обновитесь до 6.4.14
    • Обновитесь до 7.1.7
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  4. CVE-2015-2309

    Средний · CVSS 5.3Есть исправление

    Symfony has unsafe methods in the Request class

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they are not maintained anymore. ### Description The Symfony\Component\HttpFoundation\Request class provides a mechanism that ensures it does not trust HTTP header values coming from a "non-trusted" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middl

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 2.3.27
    • Обновитесь до 2.5.11
    • Обновитесь до 2.6.6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  5. CVE-2014-6061

    Средний · CVSS 5.3Есть исправление

    Symfony has a security issue when parsing the Authorization header

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore. ### Description When an application uses an HTTP basic or digest authentication, Symfony does not parse the `Authorization` header properly, which could be exploited in some server setups (no exploits have been demonstrated though.) ### Resolution The parsing of the `Authorization` header has been fixed to comply to the HTTP specification. The patc

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 2.3.19
    • Обновитесь до 2.4.9
    • Обновитесь до 2.5.4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  6. CVE-2014-5244

    Высокий · CVSS 7.5Есть исправление

    Symfony vulnerable to denial of service via a malicious HTTP Host header

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore. Description When an arbitrarily long hostname is sent by a client, its parsing in `Request::getHost()` can lead to a DoS attack, due to the way we validate the hostname via a regular expression. Resolution The regular expression used to parse and validate the hostname from the HTTP request has been modified to avoid too much sensitivity to the submi

    symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 2.3.19
    • Обновитесь до 2.4.9
    • Обновитесь до 2.5.4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  7. GHSA-vfm6-r2gc-pwww

    Без оценкиЕсть исправление

    Symfony2 security issue when the trust proxy mode is enabled

    An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp() method for sensitive decisions like IP based access control. To fix this security issue, the following changes have been made to all versions of Symfony2: A new Request::setTrustedProxies() method has been introduced and should be used intead of Request::trustProxyData() to enable the trust proxy mode. It takes an array of trusted proxy IP addresses as its argument: ``` // before (probably in your front controller script) Request::trustProxyData(); // after Request::setTrustedProxies(array('1.1.1.1')); // 1.1.1.1 being the IP address of

    symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 2.0.19
    • Обновитесь до 2.1.4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  8. CVE-2020-5255

    Низкий · CVSS 2.6EPSS 1,3%Есть исправление

    Prevent cache poisoning via a Response Content-Type header

    In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

    symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 4.4.7
    • Обновитесь до 5.0.7
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  9. CVE-2013-4752

    Средний · CVSS 6.1EPSS 2,31%Есть исправление

    CVE-2013-4752

    Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 2.0.24
    • Обновитесь до 2.1.12
    • Обновитесь до 2.2.5
    • Обновитесь до 2.3.3
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  10. CVE-2019-18888

    Высокий · CVSS 7.5EPSS 2,25%Есть исправление

    CVE-2019-18888

    An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 2.8.52
    • Обновитесь до 3.4.35
    • Обновитесь до 4.2.12
    • Обновитесь до 4.3.8
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  11. CVE-2019-10913

    Критический · CVSS 9.8EPSS 1,87%Есть исправление

    CVE-2019-10913

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 2.7.51
    • Обновитесь до 2.8.50
    • Обновитесь до 3.4.26
    • Обновитесь до 4.1.12
    • Обновитесь до 4.2.7
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  12. CVE-2018-14773

    Средний · CVSS 6.5EPSS 57,64%Есть исправление

    CVE-2018-14773

    An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRI

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 2.7.49
    • Обновитесь до 2.8.44
    • Обновитесь до 3.3.18
    • Обновитесь до 3.4.14
    • Обновитесь до 4.0.14
    • Обновитесь до 4.1.3
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  13. CVE-2018-11386

    Средний · CVSS 5.9EPSS 1,58%Есть исправление

    CVE-2018-11386

    An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

    symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundation symfony/http-foundationPHP
    • Обновитесь до 2.7.48
    • Обновитесь до 2.8.41
    • Обновитесь до 3.3.17
    • Обновитесь до 3.4.11
    • Обновитесь до 4.0.11
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  14. CVE-2012-6431

    Без оценкиEPSS 1,88%Есть исправление

    CVE-2012-6431

    Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

    symfony/http-foundationPHP
    • Обновитесь до 2.0.19
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →