⚠️Today : 0 critical vulnerabilities | 0 high vulnerabilities | 1 medium vulnerabilities | 0 low vulnerabilities - You can now download lists of IOCs here !

CVE-2024-51754

Nov. 6, 2024, 8:15 p.m.

CVSS Score

2.2 / 10

Product(s) Impacted

Twig

  • 3.11.2
  • 3.14.1

Description

Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

Weaknesses

CWE-668
Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

CWE ID: 668

Date

Published: Nov. 6, 2024, 8:15 p.m.

Last Modified: Nov. 6, 2024, 8:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

Base Score
2.2
Exploitability Score
0.7
Impact Score
1.4
Base Severity
LOW
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/ security-advisories@github.com

https://github.com/ security-advisories@github.com