In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
References
Link | Resource |
---|---|
https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec | Patch Third Party Advisory |
https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides | Third Party Advisory |
https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec | Patch Third Party Advisory |
https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 04:20
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec - Patch, Third Party Advisory | |
References | () https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides - Third Party Advisory |
Information
Published : 2019-05-16 22:29
Updated : 2024-11-21 04:20
NVD link : CVE-2019-10913
Mitre link : CVE-2019-10913
CVE.ORG link : CVE-2019-10913
JSON object : View
Products Affected
sensiolabs
- symfony