In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
References
Link | Resource |
---|---|
https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec | Patch Third Party Advisory |
https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2019-05-16 22:29
Updated : 2024-02-28 17:08
NVD link : CVE-2019-10913
Mitre link : CVE-2019-10913
CVE.ORG link : CVE-2019-10913
JSON object : View
Products Affected
sensiolabs
- symfony