CVE-2024-51754 (Low) detected in twig/twig-4.x-dev

[mend-bolt-for-github]

CVE-2024-51754 - Low Severity Vulnerability

Vulnerable Library - twig/twig-4.x-dev

Twig, the flexible, fast, and secure template language for PHP

Library home page: https://api.github.com/repos/twigphp/Twig/zipball/1493fdfb1902ab150a5c815528a6bf3b1094697a

Dependency Hierarchy:

• corneltek/cliframework-3.0.x-dev (Root Library)
  • corneltek/codegen-2.3.0
    • ❌ twig/twig-4.x-dev (Vulnerable Library)

Found in HEAD commit: 81f84f058af0cbca57ee22476557ded21c6813aa

Found in base branch: master

Vulnerability Details

Twig is a template language for PHP. In a sandbox, an attacker can call "__toString()" on an object even if the "__toString()" method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

Publish Date: 2024-11-06

URL: CVE-2024-51754

CVSS 3 Score Details (2.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6377-hfv9-hqf6

Release Date: 2024-11-06

Fix Resolution: twig/twig-3.11.2,3.14.1

---

Step up your Open Source Security Game with Mend here