Today > vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-51755

Nov. 8, 2024, 7:01 p.m.

CVSS Score

2.2 / 10

Product(s) Impacted

Twig

  • 3.11.2
  • 3.14.1

Description

Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

Weaknesses

CWE-668
Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

CWE ID: 668

Date

Published: Nov. 6, 2024, 8:15 p.m.

Last Modified: Nov. 8, 2024, 7:01 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

Base Score
2.2
Exploitability Score
0.7
Impact Score
1.4
Base Severity
LOW
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/ security-advisories@github.com

https://github.com/ security-advisories@github.com