VULNERABILITY INTELLIGENCE

CVE-2019-10913

CVSS score9.8 CRITICAL

EPSS probability1.87%

CISA KEVNot currently listed

Published2019-05-16

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.

Weakness classification

nvd@nist.gov: CWE-79

Primary references

cve@mitre.org — Patch, Third Party Advisory
cve@mitre.org — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory