CVE-2018-14773

CVE-2018-14773 is a medium-severity vulnerability in Sensiolabs Symfony with a CVSS 3.x base score of 6.5. Its EPSS exploit-prediction score of 58% places it in the 99th percentile, indicating an elevated likelihood of exploitation.

Key facts

Description

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.

Frequently asked questions

What is CVE-2018-14773?
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
How severe is CVE-2018-14773?
CVE-2018-14773 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2018-14773 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 58% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-14773?
CVE-2018-14773 primarily affects Sensiolabs Symfony. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2018-14773?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-14773 published?
CVE-2018-14773 was published on 2018-08-03 and last updated on 2026-06-17.

References

Affected products (4)

More vulnerabilities in Sensiolabs Symfony

All CVEs affecting Sensiolabs Symfony →