Vulnerability Report

CVE-2013-4752

Title: Sensiolabs Symfony Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)

Proof Of Concept

No public PoC currently indexed for CVE-2013-4752.

CWE Category CWE-79

Published Date Jan 02, 2020

Modified Date Nov 21, 2024

Exploit Status Not Found

Score 6.1 CVSS v3.1

Exploit Probability (EPSS)

2.31%

Vulnerability Summary

CVE-2013-4752: Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.

Impacted Vendors

auth0 1

sensiolabs 1

Reference Links

http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114450.html http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114461.html http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released http://www.securityfocus.com/bid/61715 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4752 https://exchange.xforce.ibmcloud.com/vulnerabilities/86365 https://exchange.xforce.ibmcloud.com/vulnerabilities/86366 https://exchange.xforce.ibmcloud.com/vulnerabilities/86367 https://exchange.xforce.ibmcloud.com/vulnerabilities/86368 https://exchange.xforce.ibmcloud.com/vulnerabilities/86369 https://exchange.xforce.ibmcloud.com/vulnerabilities/86370 https://exchange.xforce.ibmcloud.com/vulnerabilities/86371 https://exchange.xforce.ibmcloud.com/vulnerabilities/86372 https://exchange.xforce.ibmcloud.com/vulnerabilities/86373 https://exchange.xforce.ibmcloud.com/vulnerabilities/86374 http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114450.html http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114461.html http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released http://www.securityfocus.com/bid/61715 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4752 https://exchange.xforce.ibmcloud.com/vulnerabilities/86365 https://exchange.xforce.ibmcloud.com/vulnerabilities/86366 https://exchange.xforce.ibmcloud.com/vulnerabilities/86367 https://exchange.xforce.ibmcloud.com/vulnerabilities/86368 https://exchange.xforce.ibmcloud.com/vulnerabilities/86369 https://exchange.xforce.ibmcloud.com/vulnerabilities/86370 https://exchange.xforce.ibmcloud.com/vulnerabilities/86371 https://exchange.xforce.ibmcloud.com/vulnerabilities/86372 https://exchange.xforce.ibmcloud.com/vulnerabilities/86373 https://exchange.xforce.ibmcloud.com/vulnerabilities/86374

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2013-4752 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

November 21, 2024 MODIFIED

Vulnerability data or affected products updated.

January 02, 2020 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction REQUIRED

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected Stack

No specific products linked.