-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/http-foundation | composer | >= 2.0.0, < 2.3.27 | 2.3.27 |
| symfony/http-foundation | composer | >= 2.4.0, < 2.5.11 | 2.5.11 |
| symfony/http-foundation | composer | >= 2.6.0, < 2.6.6 | 2.6.6 |
| symfony/symfony | composer | >= 2.0.0, < 2.3.27 | 2.3.27 |
| symfony/symfony | composer | >= 2.4.0, < 2.5.11 | 2.5.11 |
| symfony/symfony | composer | >= 2.6.0, < 2.6.6 | 2.6.6 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from these methods trusting HTTP headers (X-Forwarded-* etc.) based solely on the presence of any configured trusted proxies, without verifying the actual remote address making the request. The commit diff shows they previously checked self::$trustedProxies existence but not whether the current REMOTE_ADDR was in that list. This allowed MITM attacks between the last trusted proxy and server. The patch introduced isFromTrustedProxy() to validate REMOTE_ADDR against trusted proxies before trusting headers.
Ongoing coverage of React2Shell