Skip to main content

Exposure of Resource to Wrong Sphere

CVE-2024-51755

Low
2.2/10

Summary

Twig is a template language for PHP. In a sandbox, and attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a "BC" break. This vulnerability affects twig/twig package versions through 3.11.1, and 3.12.0 through 3.14.0. All users are advised to upgrade. There are no known workarounds for this issue.

  • HIGH
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • HIGH
  • LOW
  • NONE

CWE-668 - Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

References

Advisory Timeline

  • Published