Skip to content
Fencer Vulns
medium 6.5

CVE-2018-14773 json

Symfony HTTP Foundation web cache poisoning

published 2018-08-03 8 y ago modified 2026-06-17 4 mo ago also GHSA-8wgj-6wx8-h5hq , EUVD-2022-3252

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
57.6%
EPSS 57.6% chance of exploitation in 30 days, percentile 99%
public exploits
0
none known

Summary

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.

Patch / fix

  • packagist symfony/http-foundation 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.3
  • packagist symfony/symfony 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.3
  • drupal drupal 8.5.6
  • symfony Debian 14, Debian 13, Debian 12 3.4.14+dfsg-1

debian advisories DEBIAN-CVE-2018-14773

  • drupal Arch Linux 8.5.6-1

arch linux advisories AVG-744

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-14773 updated cvss 6.5

php-symfony: Legacy HTTP headers allow users to modify URLs and bypass restrictions

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

57.64% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
packagist symfony/http-foundation
>=2.7.0, <2.7.49
>=2.8.0, <2.8.44
>=3.0.0, <3.3.18
>=3.4.0, <3.4.14
>=4.0.0, <4.0.14
>=4.1.0, <4.1.3
2.7.49
2.8.44
3.3.18
3.4.14
4.0.14
4.1.3
packagist symfony/symfony
>=2.7.0, <2.7.49
>=2.8.0, <2.8.44
>=3.0.0, <3.3.18
>=3.4.0, <3.4.14
>=4.0.0, <4.0.14
>=4.1.0, <4.1.3
2.7.49
2.8.44
3.3.18
3.4.14
4.0.14
4.1.3

Classification

Weakness
  • CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.