The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability or is it about accessing restricted content?
Ref.
https://www.drupal.org/SA-CORE-2018-005
https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers
The specific vulnerability seems to be the ability of a requester to send one request path to the webserver, but use an HTTP header to make Drupal see a different path.
The rewrite happens early, so the access layer in Drupal/Symfony runs as intended. But it bypasses path-based restrictions that happen earlier ("on higher level caches and web servers", according to the CVE at https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers).
For example, if you use .htaccess to restrict /admin/* from outside your IP range, that might be bypassed, but Drupal's own access system will still work as it should.
At https://www.cybersecurity-help.cz/vdb/SB2018080118?affChecked=1 this vulnerability is described as low-risk. I haven't been able to find anything that describes in any detail how it can be exploited, though.
