CVE-2018-14773

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.

• http://www.securityfocus.com/bid/104943Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041405Third Party Advisory, VDB Entry
• https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6bIssue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/03/msg00009.htmlMailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/May/21Issue Tracking, Mailing List, Third Party Advisory
• https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headersPatch, Vendor Advisory
• https://www.debian.org/security/2019/dsa-4441Third Party Advisory
• https://www.drupal.org/SA-CORE-2018-005Patch, Third Party Advisory
• http://www.securityfocus.com/bid/104943Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041405Third Party Advisory, VDB Entry
• https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6bIssue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/03/msg00009.htmlMailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/May/21Issue Tracking, Mailing List, Third Party Advisory
• https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headersPatch, Vendor Advisory
• https://www.debian.org/security/2019/dsa-4441Third Party Advisory
• https://www.drupal.org/SA-CORE-2018-005Patch, Third Party Advisory

Published

Aug 3, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14767In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted S…
• CVE-2018-14768Various VIVOTEK FD8*, FD9*, FE9*, IB8*, IB9*, IP9*, IZ9*, MS…
• CVE-2018-14769VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.
• CVE-2018-14770VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote…
• CVE-2018-14771VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote…
• CVE-2018-14772Pydio 4.2.1 through 8.2.1 has an authenticated remote code e…
• CVE-2018-14774An issue was discovered in HttpKernel in Symfony 2.7.0 throu…
• CVE-2018-14775tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3…
• CVE-2018-14776Click Studios Passwordstate before 8.3 Build 8397 allows XSS…
• CVE-2018-14777An issue was discovered in DataLife Engine (DLE) through 13.…
• CVE-2018-14779A buffer overflow issue was discovered in the Yubico-Piv 1.5…
• CVE-2018-1478IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5…6.1