CVE - CVE-2021-41267

CVE-ID
CVE-2021-41267	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2, maintainers added support for the `X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` header, leading to a web cache poisoning issue. Versions 5.3.12 and later have a patch to ensure that the `X-Forwarded-Prefix` header is not forwarded to subrequests when it is not trusted.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q URL:https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q MISC:https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487 URL:https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487 MISC:https://github.com/symfony/symfony/pull/44243 URL:https://github.com/symfony/symfony/pull/44243 MISC:https://github.com/symfony/symfony/releases/tag/v5.3.12 URL:https://github.com/symfony/symfony/releases/tag/v5.3.12
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20210915	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210915)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)