CVE-2013-4752: Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue...

Security readout for executives and security teams

Older Symfony 2 applications may trust a manipulated Host header when building absolute URLs. That can let a remote attacker cause malicious content or links to appear in application-generated pages. The sources name fixed Symfony releases, but provide no CVSS score or confirmed active exploitation. Exposure is mainly legacy PHP applications still running affected Symfony 2 branches or distribution packages containing vulnerable HttpFoundation code. Risk is higher where the application generates absolute URLs from incoming requests. Handle as a targeted legacy-risk cleanup. It is not KEV-listed in the provided data, but internet-facing affected Symfony 2 applications should be upgraded or retired because the flaw can support convincing content injection. Mitigation focus: Upgrade Symfony to 2.0.24, 2.1.12, 2.2.5, 2.3.3, or later fixed versions.; Apply relevant distribution package updates where Symfony came from Fedora or Red Hat packages.; Review Symfony and vendor guidance for required Host header or trusted proxy configuration..

Prepared

Jun 6, 2026, 03:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.