CVE-2024-51755 LOW

CVE-2024-51755: Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig

Vendor Twigphp
Product Twig
Weakness CWE-668
Published November 6, 2024
Last update November 7, 2024
View on NVD All CVEs

CVSS base score

2.2/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

November 6, 2024 CVE published
November 7, 2024 Record updated