Search for vulnerabilities
Vulnerability details: VCID-2nm9-bzfc-97ct
Vulnerability ID VCID-2nm9-bzfc-97ct
Aliases CVE-2018-14774
GHSA-66p6-7p29-55p9
Summary Symfony Host Header Injection An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-20 Improper Input Validation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2018-14774
cvssv3.1 7.2 https://github.com/symfony/symfony
generic_textual HIGH https://github.com/symfony/symfony
cvssv3.1 7.2 https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a
generic_textual HIGH https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a
cvssv3.1 7.2 https://github.com/symfony/symfony/commit/7f912bbb78377c2ea331b3da28363435fbd91337
generic_textual HIGH https://github.com/symfony/symfony/commit/7f912bbb78377c2ea331b3da28363435fbd91337
cvssv3.1 7.2 https://github.com/symfony/symfony/commit/96504fb8c9f91204727d2930eb837473ce154956
generic_textual HIGH https://github.com/symfony/symfony/commit/96504fb8c9f91204727d2930eb837473ce154956
cvssv3.1 7.2 https://github.com/symfony/symfony/commit/974240e178bb01d734bf1df1ad5c3beba6a2f982
generic_textual HIGH https://github.com/symfony/symfony/commit/974240e178bb01d734bf1df1ad5c3beba6a2f982
cvssv3.1 7.2 https://github.com/symfony/symfony/commit/9cfcaba0bf71f87683510b5f47ebaac5f5d6a5ba
generic_textual HIGH https://github.com/symfony/symfony/commit/9cfcaba0bf71f87683510b5f47ebaac5f5d6a5ba
cvssv3.1 7.2 https://github.com/symfony/symfony/commit/bcf5897bb1a99d4acae8bf7b73e81bfdeaac0922
generic_textual HIGH https://github.com/symfony/symfony/commit/bcf5897bb1a99d4acae8bf7b73e81bfdeaac0922
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2018-14774
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2018-14774
cvssv3.1 7.2 https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache
generic_textual HIGH https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2018-14774
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14774
https://github.com/symfony/symfony
https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a
https://github.com/symfony/symfony/commit/7f912bbb78377c2ea331b3da28363435fbd91337
https://github.com/symfony/symfony/commit/96504fb8c9f91204727d2930eb837473ce154956
https://github.com/symfony/symfony/commit/974240e178bb01d734bf1df1ad5c3beba6a2f982
https://github.com/symfony/symfony/commit/9cfcaba0bf71f87683510b5f47ebaac5f5d6a5ba
https://github.com/symfony/symfony/commit/bcf5897bb1a99d4acae8bf7b73e81bfdeaac0922
https://nvd.nist.gov/vuln/detail/CVE-2018-14774
https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/symfony/symfony
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/symfony/symfony/commit/7f912bbb78377c2ea331b3da28363435fbd91337
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/symfony/symfony/commit/96504fb8c9f91204727d2930eb837473ce154956
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/symfony/symfony/commit/974240e178bb01d734bf1df1ad5c3beba6a2f982
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/symfony/symfony/commit/9cfcaba0bf71f87683510b5f47ebaac5f5d6a5ba
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/symfony/symfony/commit/bcf5897bb1a99d4acae8bf7b73e81bfdeaac0922
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-14774
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.36963
EPSS Score 0.00153
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:27:06.119203+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-66p6-7p29-55p9/GHSA-66p6-7p29-55p9.json 36.1.3