CVE-2018-14773
Symfony HTTP Foundation web cache poisoning
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
- Record
CVE-2018-14773- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
- Record
CVE-2018-14773- Updated
- 2026-11-02
EUVDEUVD-2022-3252 No score
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
- Record
EUVD-2022-3252- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8wgj-6wx8-h5hq
Symfony HTTP Foundation web cache poisoning
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
- Record
GHSA-8wgj-6wx8-h5hq- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-349
- Updated
- 2026-11-02
OSV
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
- Record
CVE-2018-14773- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-14773
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
- Record
DEBIAN-CVE-2018-14773- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-8wgj-6wx8-h5hq
Symfony HTTP Foundation web cache poisoning
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
- Record
GHSA-8wgj-6wx8-h5hq- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-349
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-14773
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
- Record
UBUNTU-CVE-2018-14773- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/http-foundationPackagist |
2.7.0 up to 2.7.49 | 2.7.49 |
symfony/http-foundationPackagist |
2.8.0 up to 2.8.44 | 2.8.44 |
symfony/http-foundationPackagist |
3.0.0 up to 3.3.18 | 3.3.18 |
symfony/http-foundationPackagist |
3.4.0 up to 3.4.14 | 3.4.14 |
symfony/http-foundationPackagist |
4.0.0 up to 4.0.14 | 4.0.14 |
symfony/http-foundationPackagist |
4.1.0 up to 4.1.3 | 4.1.3 |
symfony/symfonyPackagist |
2.7.0 up to 2.7.49 | 2.7.49 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.44 | 2.8.44 |
symfony/symfonyPackagist |
3.0.0 up to 3.3.18 | 3.3.18 |
symfony/symfonyPackagist |
3.4.0 up to 3.4.14 | 3.4.14 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfony/symfonyPackagist |
4.0.0 up to 4.0.14 | 4.0.14 |
symfony/symfonyPackagist |
4.1.0 up to 4.1.3 | 4.1.3 |
symfonyDebian:12 |
before 3.4.14+dfsg-1 | 3.4.14+dfsg-1 |
symfonyDebian:13 |
before 3.4.14+dfsg-1 | 3.4.14+dfsg-1 |
symfonyDebian:14 |
before 3.4.14+dfsg-1 | 3.4.14+dfsg-1 |
symfonyDebian:8 From an advisory covering 7 CVEs |
before 2.3.21+dfsg-4+deb8u4, plus listed versions 2.3.21+dfsg-42.3.21+dfsg-4+deb8u12.3.21+dfsg-4+deb8u22.3.21+dfsg-4+deb8u3 |
2.3.21+dfsg-4+deb8u4 |
symfonyDebian:9 From an advisory covering 8 CVEs |
before 2.8.7+dfsg-1.3+deb9u2, plus listed versions 2.8.7+dfsg-1.32.8.7+dfsg-1.3+deb9u1 |
2.8.7+dfsg-1.3+deb9u2 |
symfony/http-foundationPackagist |
2.7.0 up to 2.7.49, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 44 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.49 |
symfony/http-foundationPackagist |
2.8.0 up to 2.8.44, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 39 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.44 |
symfony/http-foundationPackagist |
3.0.0 up to 3.3.18, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.3.18 |
symfony/http-foundationPackagist |
3.4.0 up to 3.4.14, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.11v3.4.12 Show 9 moreShow lessv3.4.13v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.14 |
symfony/http-foundationPackagist |
4.0.0 up to 4.0.14, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 9 moreShow lessv4.0.13v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.14 |
symfony/http-foundationPackagist |
4.1.0 up to 4.1.3, plus listed versions v4.1.0v4.1.1v4.1.2 |
4.1.3 |
symfony/symfonyPackagist |
2.7.0 up to 2.7.49, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 44 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9 |
2.7.49 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.44, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 39 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.44 |
symfony/symfonyPackagist |
3.0.0 up to 3.3.18, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.3.18 |
symfony/symfonyPackagist |
3.4.0 up to 3.4.14, plus listed versions v3.4.0v3.4.1v3.4.10v3.4.11v3.4.12 Show 9 moreShow lessv3.4.13v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9 |
3.4.14 |
symfony/symfonyPackagist |
4.0.0 up to 4.0.14, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 9 moreShow lessv4.0.13v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9 |
4.0.14 |
symfony/symfonyPackagist |
4.1.0 up to 4.1.3, plus listed versions v4.1.0v4.1.1v4.1.2 |
4.1.3 |
symfonyUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2 |
None known |
symfonyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-14773 is a medium vulnerability (CVSS 6.5) in Sensiolabs Symfony, published August 3, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 57.6%, the 99th percentile. Fixed in symfony/http-foundation 2.7.49.
References
securityfocus.com/bid/104943
drupal.org/SA-CORE-2018-005
lists.debian.org/debian-lts-announce/2019/03/msg00009.html
symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers
github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b
securitytracker.com/id/1041405
Show 9 moreShow less
debian.org/security/2019/dsa-4441
seclists.org/bugtraq/2019/May/21
nvd.nist.gov/vuln/detail/CVE-2018-14773
security-tracker.debian.org/tracker/CVE-2018-14773
ubuntu.com/security/CVE-2018-14773
cve.org/CVERecord?id=CVE-2018-14773
Left out here: 22 versions. The JSON record has them.