Vulnerability in Symfony HTTP Methods Validation

CVE-2019-10913

Summary

The Symfony framework versions prior to 2.7.51, 2.8.50, 3.4.26, 4.1.12, and 4.2.7 are susceptible to an issue where HTTP methods supplied as verbs or through the override header are inadequately validated. This lack of validation exposes applications to potential SQL injection and cross-site scripting (XSS) vulnerabilities, allowing attackers to exploit these weaknesses to inject malicious code or manipulate the backend database.

References