-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/http-foundation | composer | >= 2.0.0, < 2.0.19 | 2.0.19 |
| symfony/http-foundation | composer | >= 2.1.0, < 2.1.4 | 2.1.4 |
| symfony/symfony | composer | >= 2.0.0, < 2.0.19 | 2.0.19 |
| symfony/symfony | composer | >= 2.1.0, < 2.1.4 | 2.1.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key functions: 1) trustProxyData() enables proxy trust without proper IP validation, creating an insecure default configuration. 2) getClientIp() relies on this insecure configuration to return client IPs from untrusted headers. Together, they allow IP spoofing when the application is behind a reverse proxy. The deprecated trustProxyData() method is particularly critical as it automatically trusts the immediate proxy (REMOTE_ADDR), while getClientIp() becomes dangerous when used with this configuration for security decisions.
Ongoing coverage of React2Shell