Threats tagged 'ghsa-4mg4-f476-cjh5'

A vulnerability in Symfony FrameworkBundle versions 7.1 prior to 7.4.23 and 8.x prior to 8.1.11, and HttpFoundation versions 7.2 prior to 7.4.23 and 8.x prior to 8.1.11, allows remote attackers to spoof client IP address, host, and scheme by abusing the framework.trusted_proxies option or Request::setTrustedProxies() method when configured with the private_ranges shortcut. This causes remote clients to be trusted as reverse proxies incorrectly, leading to IP spoofing and header manipulation.