CVE-2018-14774

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-14774
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14774.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-14774
Aliases
Downstream
Published
2018-08-03T17:29:00Z
Modified
2026-10-24T10:50:31Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.

References

Affected packages

Git / github.com/symfony/security-http

Affected ranges

Type
GIT
Repo
https://github.com/symfony/security-http
Events
Introduced
de2f3d51160791ef254010953dbde178fee9845f
Last Affected
682c866cd03064d74c884ba67ff0db212dba5575
Introduced
a8d5dd00894f8b5e3edb897f4504c51ddc442370
Last Affected
892403bc54ac626fc2f55d7a806881af070856c4
Introduced
760872233cd3147870184697e3481ffa492ac2fb
Last Affected
7cb076f64ed0310504caaad1180a211be949c5db
Introduced
33c98765dc6fec4907b7431d10e3c0945f061108
Last Affected
b73082eefd5febf28872914801eb66fe53bceae1
Introduced
afa69c531f22fb4b9fc95017ec0e5d6c77db0c3c
Last Affected
4d9d4d78bf42b47cd083780c11ee110b79c59e99
Introduced
946668ddc1fa0279fe03e2c090ebc29881f12ddb
Last Affected
30d31b4c5a97c0a23ee5b6aa8343a2745e824145
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.7.0"
                },
                {
                    "last_affected": "2.7.48"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.8.0"
                },
                {
                    "last_affected": "2.8.43"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.3.0"
                },
                {
                    "last_affected": "3.3.17"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "last_affected": "3.4.13"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.0.13"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.1.0"
                },
                {
                    "last_affected": "4.1.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v2.*
v2.7.0
v2.7.1
v2.7.10
v2.7.12
v2.7.13
v2.7.14
v2.7.15
v2.7.16
v2.7.17
v2.7.18
v2.7.19
v2.7.2
v2.7.20
v2.7.21
v2.7.22
v2.7.23
v2.7.24
v2.7.25
v2.7.26
v2.7.27
v2.7.28
v2.7.29
v2.7.3
v2.7.30
v2.7.31
v2.7.32
v2.7.33
v2.7.34
v2.7.35
v2.7.36
v2.7.37
v2.7.38
v2.7.39
v2.7.4
v2.7.40
v2.7.41
v2.7.42
v2.7.43
v2.7.44
v2.7.45
v2.7.46
v2.7.47
v2.7.48
v2.7.49
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v3.*
v3.3.0
v3.3.1
v3.3.10
v3.3.11
v3.3.12
v3.3.13
v3.3.14
v3.3.15
v3.3.16
v3.3.17
v3.3.18
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v3.3.9
v4.*
v4.0.0
v4.0.0-RC2
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14774.json"

Git / github.com/symfony/symfony

Affected ranges

Type
GIT
Repo
https://github.com/symfony/symfony
Events
Introduced
9975b1eca3de4db792a2c3e4e16f676a4aadcd46
Last Affected
34d6116e2b80351c5a6f591285a4e9381b0dd127
Introduced
5615b92cd452cd54f1433a3f53de87c096a1107f
Last Affected
e7f50768f107fa951f4c80dc447b893502cf2e89
Introduced
5a7e31c48e7cd4831efa409fffb661beb9995174
Last Affected
4639525c796227ec36652ad97192a5eb3de74f76
Introduced
0a47db379b8cc74cdd84e1e6870fafc4a4ac8351
Last Affected
c406c5a4f11fc00b60d3ec585125350418c4568d
Introduced
26ca7023b1c45dce951da7206ed70049267d27bc
Last Affected
b2fc878468756fbfac367a48a1060bbf3974e9be
Introduced
58261043876feb695640457c5675bb331a6eb3b7
Last Affected
c42cc18492fe7bbfc507822ac62e3179a6518d71
Fixed
725dee4cd8b4ccd52e335ae4b4522242cea9bd4a
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.7.0"
                },
                {
                    "last_affected": "2.7.48"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.8.0"
                },
                {
                    "last_affected": "2.8.43"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.3.0"
                },
                {
                    "last_affected": "3.3.17"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "last_affected": "3.4.13"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.0.13"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.1.0"
                },
                {
                    "last_affected": "4.1.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "725dee4cd8b4ccd52e335ae4b4522242cea9bd4a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v2.*
v2.7.0
v2.7.1
v2.7.10
v2.7.11
v2.7.12
v2.7.13
v2.7.14
v2.7.15
v2.7.16
v2.7.17
v2.7.18
v2.7.19
v2.7.2
v2.7.20
v2.7.21
v2.7.22
v2.7.23
v2.7.24
v2.7.25
v2.7.26
v2.7.27
v2.7.28
v2.7.29
v2.7.3
v2.7.30
v2.7.31
v2.7.32
v2.7.33
v2.7.34
v2.7.35
v2.7.36
v2.7.37
v2.7.38
v2.7.39
v2.7.4
v2.7.40
v2.7.41
v2.7.42
v2.7.43
v2.7.44
v2.7.45
v2.7.46
v2.7.47
v2.7.48
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v2.8.0
v2.8.1
v2.8.10
v2.8.11
v2.8.12
v2.8.13
v2.8.14
v2.8.15
v2.8.16
v2.8.17
v2.8.18
v2.8.19
v2.8.2
v2.8.20
v2.8.21
v2.8.22
v2.8.23
v2.8.24
v2.8.25
v2.8.26
v2.8.27
v2.8.28
v2.8.29
v2.8.3
v2.8.30
v2.8.31
v2.8.32
v2.8.33
v2.8.34
v2.8.35
v2.8.36
v2.8.37
v2.8.38
v2.8.39
v2.8.4
v2.8.40
v2.8.41
v2.8.42
v2.8.43
v2.8.5
v2.8.6
v2.8.7
v2.8.8
v2.8.9
v3.*
v3.3.0
v3.3.1
v3.3.10
v3.3.11
v3.3.12
v3.3.13
v3.3.14
v3.3.15
v3.3.16
v3.3.17
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v3.3.9
v4.*
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v4.1.0
v4.1.1
v4.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14774.json"