Skip to main content

Exposure of Resource to Wrong Sphere

CVE-2024-51754

Low
2.2/10

Summary

Twig is a template language for PHP. In a sandbox, an attacker can call '__toString()' on an object, even if the '__toString()' method is not allowed by the security policy, when the object is part of an array or an argument list (arguments to a function or a filter for instance). This vulnerability affects twig/twig package versions through 3.11.1, and 3.12.0 through 3.14.0. All users are advised to upgrade. There are no known workarounds for this issue.

  • HIGH
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • HIGH
  • LOW
  • NONE

CWE-668 - Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

References

Advisory Timeline

  • Published