CVE-2013-4752: XSS
Request::getHost() poisoning
Other sources
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4752?
CVE-2013-4752 is rated as medium severity due to the potential for host header poisoning attacks.
How do I fix CVE-2013-4752?
To fix CVE-2013-4752, upgrade Symfony or HttpFoundation to version 2.0.24, 2.1.12, 2.2.5, or 2.3.3 or later.
What versions are affected by CVE-2013-4752?
CVE-2013-4752 affects Symfony versions 2.0.0 to 2.0.24, 2.1.0 to 2.1.12, 2.2.0 to 2.2.5, and 2.3.0 to 2.3.3.
Can CVE-2013-4752 be exploited remotely?
Yes, an attacker can exploit CVE-2013-4752 remotely by manipulating the Host header.
What component of Symfony is affected by CVE-2013-4752?
CVE-2013-4752 affects the HttpFoundation component of Symfony.