{"schemaVersion":3,"id":"CVE-2013-4752","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.","dates":{"published":"2020-01-02T16:07:55.000Z","modified":"2024-08-06T16:52:27.085Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.1,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02313,"percentile":0.83144,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.02313},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02313,"percentile":0.83144}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02313,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02313,"percentile":0.83144}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"fedoraproject","product":"fedora","name":"fedora","label":"fedora","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"18","noFixRecorded":false,"fixedIn":null},{"text":"19","noFixRecorded":false,"fixedIn":null}],"versionsText":"18 | 19","eol":{"isEol":true,"eolDate":"2014-01-14T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"18","label":"18 (Spherical Cow)","eolFrom":"2014-01-14T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"fedora","label":"Fedora Linux","category":"os"}},"hubHref":"/vendor/fedoraproject/fedora"},{"vendor":"sensiolabs","product":"symfony","name":"symfony","label":"symfony","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0.0, < 2.0.24","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.1.0, < 2.1.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.2.0, < 2.2.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.3.0, < 2.3.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0.0, < 2.0.24 | ≥ 2.1.0, < 2.1.12 | ≥ 2.2.0, < 2.2.5 | ≥ 2.3.0, < 2.3.3","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"symfony","label":"Symfony","category":"framework"}},"hubHref":"/vendor/sensiolabs/symfony"}],"affectedCount":2,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released","label":"symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released","hostname":"symfony.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4752","label":"bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4752","hostname":"bugzilla.redhat.com","tags":["X Refsource MISC","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86367","label":"exchange.xforce.ibmcloud.com/vulnerabilities/86367","hostname":"exchange.xforce.ibmcloud.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114450.html","label":"lists.fedoraproject.org/pipermail/package-announce/2013-August/114450.html","hostname":"lists.fedoraproject.org","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114461.html","label":"lists.fedoraproject.org/pipermail/package-announce/2013-August/114461.html","hostname":"lists.fedoraproject.org","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/61715","label":"www.securityfocus.com/bid/61715","hostname":"www.securityfocus.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86365","label":"exchange.xforce.ibmcloud.com/vulnerabilities/86365","hostname":"exchange.xforce.ibmcloud.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86366","label":"exchange.xforce.ibmcloud.com/vulnerabilities/86366","hostname":"exchange.xforce.ibmcloud.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86368","label":"exchange.xforce.ibmcloud.com/vulnerabilities/86368","hostname":"exchange.xforce.ibmcloud.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86369","label":"exchange.xforce.ibmcloud.com/vulnerabilities/86369","hostname":"exchange.xforce.ibmcloud.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86370","label":"exchange.xforce.ibmcloud.com/vulnerabilities/86370","hostname":"exchange.xforce.ibmcloud.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86371","label":"exchange.xforce.ibmcloud.com/vulnerabilities/86371","hostname":"exchange.xforce.ibmcloud.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86372","label":"exchange.xforce.ibmcloud.com/vulnerabilities/86372","hostname":"exchange.xforce.ibmcloud.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86373","label":"exchange.xforce.ibmcloud.com/vulnerabilities/86373","hostname":"exchange.xforce.ibmcloud.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86374","label":"exchange.xforce.ibmcloud.com/vulnerabilities/86374","hostname":"exchange.xforce.ibmcloud.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-01-02T16:07:55.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T16:52:27.085Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T01:21:23.503Z","stale":false,"partial":false}}