CVE-2024-51755

Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig

Severity Score

2.2

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

NVD
MITRE

Twig is a template language for PHP. In a sandbox, and attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

*Credits: N/A

CVSS Scores

GitHubv3.1 2.2

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-10-31 CVE Reserved
2024-11-06 CVE Published
2024-11-07 CVE Updated
2024-11-07 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-668: Exposure of Resource to Wrong Sphere

CAPEC

References (2)

URL	Tag	Source
https://github.com/twigphp/Twig/commit/831c148e786178e5f2fde9db67266be3bf241c21	X_refsource_misc
https://github.com/twigphp/Twig/security/advisories/GHSA-jjxq-ff2g-95vh	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Twigphp Search vendor "Twigphp"		Twig Search vendor "Twigphp" for product "Twig"				< 3.11.2 Search vendor "Twigphp" for product "Twig" and version " < 3.11.2"		en		Affected
Twigphp Search vendor "Twigphp"		Twig Search vendor "Twigphp" for product "Twig"				>= 3.12.0 < 3.14.1 Search vendor "Twigphp" for product "Twig" and version " >= 3.12.0 < 3.14.1"		en		Affected