Log in Start free

Vulnerability · Published Sep 9, 2024 · Assigned by GitHub_M

CVE-2024-45411Twig has a possible sandbox bypass

High 8.6

In plain English

A high-severity security flaw in Twig from twigphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.8%top 41.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12php-twig3.5.1-1+deb12u1DEBIAN-CVE-2024-45411
Debian:12php-twig3.5.1-1+deb12u1DSA-5771-1
Debian:13php-twig3.8.0-4DEBIAN-CVE-2024-45411
Debian:14php-twig3.8.0-4DEBIAN-CVE-2024-45411
Packagisttwig/twig3.11.1GHSA-6j75-5wfj-gh66
Packagisttwig/twig3.14.0GHSA-6j75-5wfj-gh66
Packagisttwig/twig2.16.1GHSA-6j75-5wfj-gh66
Packagisttwig/twig1.44.8GHSA-6j75-5wfj-gh66
Ubuntu:24.04:LTSphp-twig3.8.0-2ubuntu1UBUNTU-CVE-2024-45411
Ubuntu:24.04:LTSphp-twig3.8.0-2ubuntu1USN-7549-1

Affected products (as reported)

VendorProductVersions
twigphp Twig > 1.0.0, < 1.44.8> 2.0.0, < 2.16.1> 3.0.0, < 3.14.0

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References