Twig Security Patch Fixes Object.__toString() Call in Arrays and Arguments
CVE-2024-51754

2.2LOW

Key Information:

Vendor

TwigPHP

Status
Twig
Vendor
CVE Published:
6 November 2024

What is CVE-2024-51754?

Twig is a template language for PHP. In a sandbox, an attacker can call __toString() on an object even if the __toString() method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

Affected Version(s)

Twig < 3.11.2 < 3.11.2

Twig >= 3.12.0, < 3.14.1 < 3.12.0, 3.14.1

References

https://github.com/twigphp/Twig/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/twigphp/Twig/commit/2bb8c2460a2c519c49...
x_refsource_MISC

CVSS V3.1

Score:
2.2
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.