CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2018-14773

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.048

EPSS Ranking 89.1%

CVSS Severity

CVSS v3 Score 6.5

CVSS v2 Score 4.0

References

Products affected by CVE-2018-14773

Drupal » Drupal » Version: 8.0.0

cpe:2.3:a:drupal:drupal:8.0.0
Drupal » Drupal » Version: 8.0.1

cpe:2.3:a:drupal:drupal:8.0.1
Drupal » Drupal » Version: 8.0.2

cpe:2.3:a:drupal:drupal:8.0.2
Drupal » Drupal » Version: 8.0.3

cpe:2.3:a:drupal:drupal:8.0.3
Drupal » Drupal » Version: 8.0.4

cpe:2.3:a:drupal:drupal:8.0.4
Drupal » Drupal » Version: 8.0.5

cpe:2.3:a:drupal:drupal:8.0.5
Drupal » Drupal » Version: 8.0.6

cpe:2.3:a:drupal:drupal:8.0.6
Drupal » Drupal » Version: 8.1.0

cpe:2.3:a:drupal:drupal:8.1.0
Drupal » Drupal » Version: 8.1.1

cpe:2.3:a:drupal:drupal:8.1.1
Drupal » Drupal » Version: 8.1.10

cpe:2.3:a:drupal:drupal:8.1.10
Drupal » Drupal » Version: 8.1.2

cpe:2.3:a:drupal:drupal:8.1.2
Drupal » Drupal » Version: 8.1.3

cpe:2.3:a:drupal:drupal:8.1.3
Drupal » Drupal » Version: 8.1.4

cpe:2.3:a:drupal:drupal:8.1.4
Drupal » Drupal » Version: 8.1.5

cpe:2.3:a:drupal:drupal:8.1.5
Drupal » Drupal » Version: 8.1.6

cpe:2.3:a:drupal:drupal:8.1.6
Drupal » Drupal » Version: 8.1.7

cpe:2.3:a:drupal:drupal:8.1.7
Drupal » Drupal » Version: 8.1.8

cpe:2.3:a:drupal:drupal:8.1.8
Drupal » Drupal » Version: 8.1.9

cpe:2.3:a:drupal:drupal:8.1.9
Drupal » Drupal » Version: 8.2.0

cpe:2.3:a:drupal:drupal:8.2.0
Drupal » Drupal » Version: 8.2.1

cpe:2.3:a:drupal:drupal:8.2.1
Drupal » Drupal » Version: 8.2.2

cpe:2.3:a:drupal:drupal:8.2.2
Drupal » Drupal » Version: 8.2.3

cpe:2.3:a:drupal:drupal:8.2.3
Drupal » Drupal » Version: 8.2.4

cpe:2.3:a:drupal:drupal:8.2.4
Drupal » Drupal » Version: 8.2.5

cpe:2.3:a:drupal:drupal:8.2.5
Drupal » Drupal » Version: 8.2.6

cpe:2.3:a:drupal:drupal:8.2.6
Drupal » Drupal » Version: 8.2.7

cpe:2.3:a:drupal:drupal:8.2.7
Drupal » Drupal » Version: 8.2.8

cpe:2.3:a:drupal:drupal:8.2.8
Drupal » Drupal » Version: 8.3.0

cpe:2.3:a:drupal:drupal:8.3.0
Drupal » Drupal » Version: 8.3.1

cpe:2.3:a:drupal:drupal:8.3.1
Drupal » Drupal » Version: 8.3.2

cpe:2.3:a:drupal:drupal:8.3.2
Drupal » Drupal » Version: 8.3.3

cpe:2.3:a:drupal:drupal:8.3.3
Drupal » Drupal » Version: 8.3.4

cpe:2.3:a:drupal:drupal:8.3.4
Drupal » Drupal » Version: 8.3.5

cpe:2.3:a:drupal:drupal:8.3.5
Drupal » Drupal » Version: 8.3.6

cpe:2.3:a:drupal:drupal:8.3.6
Drupal » Drupal » Version: 8.3.7

cpe:2.3:a:drupal:drupal:8.3.7
Drupal » Drupal » Version: 8.3.8

cpe:2.3:a:drupal:drupal:8.3.8
Drupal » Drupal » Version: 8.3.9

cpe:2.3:a:drupal:drupal:8.3.9
Drupal » Drupal » Version: 8.4.0

cpe:2.3:a:drupal:drupal:8.4.0
Drupal » Drupal » Version: 8.4.1

cpe:2.3:a:drupal:drupal:8.4.1
Drupal » Drupal » Version: 8.4.2

cpe:2.3:a:drupal:drupal:8.4.2
Drupal » Drupal » Version: 8.4.3

cpe:2.3:a:drupal:drupal:8.4.3
Drupal » Drupal » Version: 8.4.4

cpe:2.3:a:drupal:drupal:8.4.4
Drupal » Drupal » Version: 8.4.5

cpe:2.3:a:drupal:drupal:8.4.5
Drupal » Drupal » Version: 8.4.6

cpe:2.3:a:drupal:drupal:8.4.6
Drupal » Drupal » Version: 8.4.7

cpe:2.3:a:drupal:drupal:8.4.7
Drupal » Drupal » Version: 8.4.8

cpe:2.3:a:drupal:drupal:8.4.8
Drupal » Drupal » Version: 8.5.0

cpe:2.3:a:drupal:drupal:8.5.0
Drupal » Drupal » Version: 8.5.1

cpe:2.3:a:drupal:drupal:8.5.1
Drupal » Drupal » Version: 8.5.2

cpe:2.3:a:drupal:drupal:8.5.2
Drupal » Drupal » Version: 8.5.3

cpe:2.3:a:drupal:drupal:8.5.3
Drupal » Drupal » Version: 8.5.4

cpe:2.3:a:drupal:drupal:8.5.4
Drupal » Drupal » Version: 8.5.5

cpe:2.3:a:drupal:drupal:8.5.5
Sensiolabs » Symfony » Version: 2.7.1

cpe:2.3:a:sensiolabs:symfony:2.7.1
Sensiolabs » Symfony » Version: 2.7.10

cpe:2.3:a:sensiolabs:symfony:2.7.10
Sensiolabs » Symfony » Version: 2.7.11

cpe:2.3:a:sensiolabs:symfony:2.7.11
Sensiolabs » Symfony » Version: 2.7.12

cpe:2.3:a:sensiolabs:symfony:2.7.12
Sensiolabs » Symfony » Version: 2.7.13

cpe:2.3:a:sensiolabs:symfony:2.7.13
Sensiolabs » Symfony » Version: 2.7.14

cpe:2.3:a:sensiolabs:symfony:2.7.14
Sensiolabs » Symfony » Version: 2.7.15

cpe:2.3:a:sensiolabs:symfony:2.7.15
Sensiolabs » Symfony » Version: 2.7.16

cpe:2.3:a:sensiolabs:symfony:2.7.16
Sensiolabs » Symfony » Version: 2.7.17

cpe:2.3:a:sensiolabs:symfony:2.7.17
Sensiolabs » Symfony » Version: 2.7.18

cpe:2.3:a:sensiolabs:symfony:2.7.18
Sensiolabs » Symfony » Version: 2.7.19

cpe:2.3:a:sensiolabs:symfony:2.7.19
Sensiolabs » Symfony » Version: 2.7.2

cpe:2.3:a:sensiolabs:symfony:2.7.2
Sensiolabs » Symfony » Version: 2.7.20

cpe:2.3:a:sensiolabs:symfony:2.7.20
Sensiolabs » Symfony » Version: 2.7.21

cpe:2.3:a:sensiolabs:symfony:2.7.21
Sensiolabs » Symfony » Version: 2.7.22

cpe:2.3:a:sensiolabs:symfony:2.7.22
Sensiolabs » Symfony » Version: 2.7.23

cpe:2.3:a:sensiolabs:symfony:2.7.23
Sensiolabs » Symfony » Version: 2.7.24

cpe:2.3:a:sensiolabs:symfony:2.7.24
Sensiolabs » Symfony » Version: 2.7.25

cpe:2.3:a:sensiolabs:symfony:2.7.25
Sensiolabs » Symfony » Version: 2.7.26

cpe:2.3:a:sensiolabs:symfony:2.7.26
Sensiolabs » Symfony » Version: 2.7.27

cpe:2.3:a:sensiolabs:symfony:2.7.27
Sensiolabs » Symfony » Version: 2.7.28

cpe:2.3:a:sensiolabs:symfony:2.7.28
Sensiolabs » Symfony » Version: 2.7.29

cpe:2.3:a:sensiolabs:symfony:2.7.29
Sensiolabs » Symfony » Version: 2.7.3

cpe:2.3:a:sensiolabs:symfony:2.7.3
Sensiolabs » Symfony » Version: 2.7.30

cpe:2.3:a:sensiolabs:symfony:2.7.30
Sensiolabs » Symfony » Version: 2.7.31

cpe:2.3:a:sensiolabs:symfony:2.7.31
Sensiolabs » Symfony » Version: 2.7.32

cpe:2.3:a:sensiolabs:symfony:2.7.32
Sensiolabs » Symfony » Version: 2.7.33

cpe:2.3:a:sensiolabs:symfony:2.7.33
Sensiolabs » Symfony » Version: 2.7.34

cpe:2.3:a:sensiolabs:symfony:2.7.34
Sensiolabs » Symfony » Version: 2.7.35

cpe:2.3:a:sensiolabs:symfony:2.7.35
Sensiolabs » Symfony » Version: 2.7.36

cpe:2.3:a:sensiolabs:symfony:2.7.36
Sensiolabs » Symfony » Version: 2.7.37

cpe:2.3:a:sensiolabs:symfony:2.7.37
Sensiolabs » Symfony » Version: 2.7.38

cpe:2.3:a:sensiolabs:symfony:2.7.38
Sensiolabs » Symfony » Version: 2.7.39

cpe:2.3:a:sensiolabs:symfony:2.7.39
Sensiolabs » Symfony » Version: 2.7.4

cpe:2.3:a:sensiolabs:symfony:2.7.4
Sensiolabs » Symfony » Version: 2.7.40

cpe:2.3:a:sensiolabs:symfony:2.7.40
Sensiolabs » Symfony » Version: 2.7.41

cpe:2.3:a:sensiolabs:symfony:2.7.41
Sensiolabs » Symfony » Version: 2.7.42

cpe:2.3:a:sensiolabs:symfony:2.7.42
Sensiolabs » Symfony » Version: 2.7.43

cpe:2.3:a:sensiolabs:symfony:2.7.43
Sensiolabs » Symfony » Version: 2.7.44

cpe:2.3:a:sensiolabs:symfony:2.7.44
Sensiolabs » Symfony » Version: 2.7.45

cpe:2.3:a:sensiolabs:symfony:2.7.45
Sensiolabs » Symfony » Version: 2.7.46

cpe:2.3:a:sensiolabs:symfony:2.7.46
Sensiolabs » Symfony » Version: 2.7.47

cpe:2.3:a:sensiolabs:symfony:2.7.47
Sensiolabs » Symfony » Version: 2.7.48

cpe:2.3:a:sensiolabs:symfony:2.7.48
Sensiolabs » Symfony » Version: 2.7.5

cpe:2.3:a:sensiolabs:symfony:2.7.5
Sensiolabs » Symfony » Version: 2.7.6

cpe:2.3:a:sensiolabs:symfony:2.7.6
Sensiolabs » Symfony » Version: 2.7.7

cpe:2.3:a:sensiolabs:symfony:2.7.7
Sensiolabs » Symfony » Version: 2.7.8

cpe:2.3:a:sensiolabs:symfony:2.7.8
Sensiolabs » Symfony » Version: 2.7.9

cpe:2.3:a:sensiolabs:symfony:2.7.9
Sensiolabs » Symfony » Version: 2.8.0

cpe:2.3:a:sensiolabs:symfony:2.8.0
Sensiolabs » Symfony » Version: 2.8.1

cpe:2.3:a:sensiolabs:symfony:2.8.1
Sensiolabs » Symfony » Version: 2.8.10

cpe:2.3:a:sensiolabs:symfony:2.8.10
Sensiolabs » Symfony » Version: 2.8.11

cpe:2.3:a:sensiolabs:symfony:2.8.11
Sensiolabs » Symfony » Version: 2.8.12

cpe:2.3:a:sensiolabs:symfony:2.8.12
Sensiolabs » Symfony » Version: 2.8.13

cpe:2.3:a:sensiolabs:symfony:2.8.13
Sensiolabs » Symfony » Version: 2.8.14

cpe:2.3:a:sensiolabs:symfony:2.8.14
Sensiolabs » Symfony » Version: 2.8.15

cpe:2.3:a:sensiolabs:symfony:2.8.15
Sensiolabs » Symfony » Version: 2.8.16

cpe:2.3:a:sensiolabs:symfony:2.8.16
Sensiolabs » Symfony » Version: 2.8.17

cpe:2.3:a:sensiolabs:symfony:2.8.17
Sensiolabs » Symfony » Version: 2.8.18

cpe:2.3:a:sensiolabs:symfony:2.8.18
Sensiolabs » Symfony » Version: 2.8.19

cpe:2.3:a:sensiolabs:symfony:2.8.19
Sensiolabs » Symfony » Version: 2.8.2

cpe:2.3:a:sensiolabs:symfony:2.8.2
Sensiolabs » Symfony » Version: 2.8.20

cpe:2.3:a:sensiolabs:symfony:2.8.20
Sensiolabs » Symfony » Version: 2.8.21

cpe:2.3:a:sensiolabs:symfony:2.8.21
Sensiolabs » Symfony » Version: 2.8.22

cpe:2.3:a:sensiolabs:symfony:2.8.22
Sensiolabs » Symfony » Version: 2.8.23

cpe:2.3:a:sensiolabs:symfony:2.8.23
Sensiolabs » Symfony » Version: 2.8.24

cpe:2.3:a:sensiolabs:symfony:2.8.24
Sensiolabs » Symfony » Version: 2.8.25

cpe:2.3:a:sensiolabs:symfony:2.8.25
Sensiolabs » Symfony » Version: 2.8.26

cpe:2.3:a:sensiolabs:symfony:2.8.26
Sensiolabs » Symfony » Version: 2.8.27

cpe:2.3:a:sensiolabs:symfony:2.8.27
Sensiolabs » Symfony » Version: 2.8.28

cpe:2.3:a:sensiolabs:symfony:2.8.28
Sensiolabs » Symfony » Version: 2.8.29

cpe:2.3:a:sensiolabs:symfony:2.8.29
Sensiolabs » Symfony » Version: 2.8.3

cpe:2.3:a:sensiolabs:symfony:2.8.3
Sensiolabs » Symfony » Version: 2.8.30

cpe:2.3:a:sensiolabs:symfony:2.8.30
Sensiolabs » Symfony » Version: 2.8.31

cpe:2.3:a:sensiolabs:symfony:2.8.31
Sensiolabs » Symfony » Version: 2.8.32

cpe:2.3:a:sensiolabs:symfony:2.8.32
Sensiolabs » Symfony » Version: 2.8.33

cpe:2.3:a:sensiolabs:symfony:2.8.33
Sensiolabs » Symfony » Version: 2.8.34

cpe:2.3:a:sensiolabs:symfony:2.8.34
Sensiolabs » Symfony » Version: 2.8.35

cpe:2.3:a:sensiolabs:symfony:2.8.35
Sensiolabs » Symfony » Version: 2.8.36

cpe:2.3:a:sensiolabs:symfony:2.8.36
Sensiolabs » Symfony » Version: 2.8.37

cpe:2.3:a:sensiolabs:symfony:2.8.37
Sensiolabs » Symfony » Version: 2.8.38

cpe:2.3:a:sensiolabs:symfony:2.8.38
Sensiolabs » Symfony » Version: 2.8.39

cpe:2.3:a:sensiolabs:symfony:2.8.39
Sensiolabs » Symfony » Version: 2.8.4

cpe:2.3:a:sensiolabs:symfony:2.8.4
Sensiolabs » Symfony » Version: 2.8.40

cpe:2.3:a:sensiolabs:symfony:2.8.40
Sensiolabs » Symfony » Version: 2.8.41

cpe:2.3:a:sensiolabs:symfony:2.8.41
Sensiolabs » Symfony » Version: 2.8.42

cpe:2.3:a:sensiolabs:symfony:2.8.42
Sensiolabs » Symfony » Version: 2.8.43

cpe:2.3:a:sensiolabs:symfony:2.8.43
Sensiolabs » Symfony » Version: 2.8.5

cpe:2.3:a:sensiolabs:symfony:2.8.5
Sensiolabs » Symfony » Version: 2.8.6

cpe:2.3:a:sensiolabs:symfony:2.8.6
Sensiolabs » Symfony » Version: 2.8.7

cpe:2.3:a:sensiolabs:symfony:2.8.7
Sensiolabs » Symfony » Version: 2.8.8

cpe:2.3:a:sensiolabs:symfony:2.8.8
Sensiolabs » Symfony » Version: 2.8.9

cpe:2.3:a:sensiolabs:symfony:2.8.9
Sensiolabs » Symfony » Version: 3.3.0

cpe:2.3:a:sensiolabs:symfony:3.3.0
Sensiolabs » Symfony » Version: 3.3.1

cpe:2.3:a:sensiolabs:symfony:3.3.1
Sensiolabs » Symfony » Version: 3.3.10

cpe:2.3:a:sensiolabs:symfony:3.3.10
Sensiolabs » Symfony » Version: 3.3.11

cpe:2.3:a:sensiolabs:symfony:3.3.11
Sensiolabs » Symfony » Version: 3.3.12

cpe:2.3:a:sensiolabs:symfony:3.3.12
Sensiolabs » Symfony » Version: 3.3.13

cpe:2.3:a:sensiolabs:symfony:3.3.13
Sensiolabs » Symfony » Version: 3.3.14

cpe:2.3:a:sensiolabs:symfony:3.3.14
Sensiolabs » Symfony » Version: 3.3.15

cpe:2.3:a:sensiolabs:symfony:3.3.15
Sensiolabs » Symfony » Version: 3.3.16

cpe:2.3:a:sensiolabs:symfony:3.3.16
Sensiolabs » Symfony » Version: 3.3.17

cpe:2.3:a:sensiolabs:symfony:3.3.17
Sensiolabs » Symfony » Version: 3.3.2

cpe:2.3:a:sensiolabs:symfony:3.3.2
Sensiolabs » Symfony » Version: 3.3.3

cpe:2.3:a:sensiolabs:symfony:3.3.3
Sensiolabs » Symfony » Version: 3.3.4

cpe:2.3:a:sensiolabs:symfony:3.3.4
Sensiolabs » Symfony » Version: 3.3.5

cpe:2.3:a:sensiolabs:symfony:3.3.5
Sensiolabs » Symfony » Version: 3.3.6

cpe:2.3:a:sensiolabs:symfony:3.3.6
Sensiolabs » Symfony » Version: 3.3.7

cpe:2.3:a:sensiolabs:symfony:3.3.7
Sensiolabs » Symfony » Version: 3.3.8

cpe:2.3:a:sensiolabs:symfony:3.3.8
Sensiolabs » Symfony » Version: 3.3.9

cpe:2.3:a:sensiolabs:symfony:3.3.9
Sensiolabs » Symfony » Version: 3.4.0

cpe:2.3:a:sensiolabs:symfony:3.4.0
Sensiolabs » Symfony » Version: 3.4.1

cpe:2.3:a:sensiolabs:symfony:3.4.1
Sensiolabs » Symfony » Version: 3.4.10

cpe:2.3:a:sensiolabs:symfony:3.4.10
Sensiolabs » Symfony » Version: 3.4.11

cpe:2.3:a:sensiolabs:symfony:3.4.11
Sensiolabs » Symfony » Version: 3.4.12

cpe:2.3:a:sensiolabs:symfony:3.4.12
Sensiolabs » Symfony » Version: 3.4.13

cpe:2.3:a:sensiolabs:symfony:3.4.13
Sensiolabs » Symfony » Version: 3.4.2

cpe:2.3:a:sensiolabs:symfony:3.4.2
Sensiolabs » Symfony » Version: 3.4.3

cpe:2.3:a:sensiolabs:symfony:3.4.3
Sensiolabs » Symfony » Version: 3.4.4

cpe:2.3:a:sensiolabs:symfony:3.4.4
Sensiolabs » Symfony » Version: 3.4.5

cpe:2.3:a:sensiolabs:symfony:3.4.5
Sensiolabs » Symfony » Version: 3.4.6

cpe:2.3:a:sensiolabs:symfony:3.4.6
Sensiolabs » Symfony » Version: 3.4.7

cpe:2.3:a:sensiolabs:symfony:3.4.7
Sensiolabs » Symfony » Version: 3.4.8

cpe:2.3:a:sensiolabs:symfony:3.4.8
Sensiolabs » Symfony » Version: 3.4.9

cpe:2.3:a:sensiolabs:symfony:3.4.9
Sensiolabs » Symfony » Version: 4.0.0

cpe:2.3:a:sensiolabs:symfony:4.0.0
Sensiolabs » Symfony » Version: 4.0.1

cpe:2.3:a:sensiolabs:symfony:4.0.1
Sensiolabs » Symfony » Version: 4.0.10

cpe:2.3:a:sensiolabs:symfony:4.0.10
Sensiolabs » Symfony » Version: 4.0.11

cpe:2.3:a:sensiolabs:symfony:4.0.11
Sensiolabs » Symfony » Version: 4.0.12

cpe:2.3:a:sensiolabs:symfony:4.0.12
Sensiolabs » Symfony » Version: 4.0.13

cpe:2.3:a:sensiolabs:symfony:4.0.13
Sensiolabs » Symfony » Version: 4.0.2

cpe:2.3:a:sensiolabs:symfony:4.0.2
Sensiolabs » Symfony » Version: 4.0.3

cpe:2.3:a:sensiolabs:symfony:4.0.3
Sensiolabs » Symfony » Version: 4.0.4

cpe:2.3:a:sensiolabs:symfony:4.0.4
Sensiolabs » Symfony » Version: 4.0.5

cpe:2.3:a:sensiolabs:symfony:4.0.5
Sensiolabs » Symfony » Version: 4.0.6

cpe:2.3:a:sensiolabs:symfony:4.0.6
Sensiolabs » Symfony » Version: 4.0.7

cpe:2.3:a:sensiolabs:symfony:4.0.7
Sensiolabs » Symfony » Version: 4.0.8

cpe:2.3:a:sensiolabs:symfony:4.0.8
Sensiolabs » Symfony » Version: 4.0.9

cpe:2.3:a:sensiolabs:symfony:4.0.9
Sensiolabs » Symfony » Version: 4.1.0

cpe:2.3:a:sensiolabs:symfony:4.1.0
Sensiolabs » Symfony » Version: 4.1.1

cpe:2.3:a:sensiolabs:symfony:4.1.1
Sensiolabs » Symfony » Version: 4.1.2

cpe:2.3:a:sensiolabs:symfony:4.1.2
Debian » Debian Linux » Version: 8.0

cpe:2.3:o:debian:debian_linux:8.0
Debian » Debian Linux » Version: 9.0

cpe:2.3:o:debian:debian_linux:9.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2018-14773

Products

Pricing

Contact Us