CVE-2021-41267

Katalog CVE

CVSS 6.5 · Medium EPSS 1,3%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada sensiolabs symfony. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2, maintainers added support for the `X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` header, leading to a web cache poisoning issue. Versions 5.3.12 and later have a patch to ensure that the `X-Forwarded-Prefix` header is not forwarded to subrequests when it is not trusted.

Rincian

Terbit di NVD

24 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487 patch · advisory pihak ketiga
• https://github.com/symfony/symfony/pull/44243 patch · advisory pihak ketiga
• https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q patch · advisory pihak ketiga
• https://github.com/symfony/symfony/releases/tag/v5.3.12 release notes · advisory pihak ketiga