{"action":"Upgrade symfony/http-foundation to 2.7.51 or later.","affected":[{"fixed":"2.7.51","introduced":"2.7.0"},{"fixed":"2.8.50","introduced":"2.8.0"},{"fixed":"3.4.26","introduced":"3.0.0"},{"fixed":"4.1.12","introduced":"4.0.0"},{"fixed":"4.2.7","introduced":"4.2.0"}],"component":"symfony/http-foundation","cve_ids":["CVE-2019-10913"],"ecosystem":"Packagist","epss":0.01871,"exploited":false,"fixed_versions":["2.7.51","2.8.50","3.4.26","4.1.12","4.2.7"],"ghsa_id":"GHSA-x92h-wmg2-6hp7","id":"tcs_01M5KFAWK2NYV48HBVN2WWAN4E","modified_at":"2023-11-08T04:00:58.948619Z","published_at":"2019-12-02T18:10:24Z","references":["https://osv.dev/vulnerability/GHSA-x92h-wmg2-6hp7","https://nvd.nist.gov/vuln/detail/CVE-2019-10913","https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-10913.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10913.yaml","https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides","https://symfony.com/cve-2019-10913"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-x92h-wmg2-6hp7","url":"https://osv.dev/vulnerability/GHSA-x92h-wmg2-6hp7"}],"summary":"Invalid HTTP method overrides allow possible XSS or other attacks in Symfony"}