CVE-2013-4752: fedoraproject fedora Cross-site Scripting
Vulnerability summary
CVE-2013-4752 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in fedoraproject fedora. EPSS estimates a 2.31% chance of exploitation in the next 30 days, higher than 83.1% of scored vulnerabilities.
Timeline
- 02-01-2020PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.31%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.31% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fedoraproject1 product
- fedoraEOL18 | 19
Sensiolabs1 product
- symfony≥ 2.0.0, < 2.0.24 | ≥ 2.1.0, < 2.1.12 | ≥ 2.2.0, < 2.2.5 | ≥ 2.3.0, < 2.3.3
2 vendors · 2 products
References
15 links- symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-releasedX Refsource CONFIRMPatchVendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4752X Refsource MISCIssue TrackingPatchThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2013-August/114450.htmlX Refsource MISCThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2013-August/114461.htmlX Refsource MISCThird Party Advisory