Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 06/11/2015 Updated: 30/10/2018

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The displayBlock function Template.php in Sensio Labs Twig prior to 1.20.0, when Sandbox mode is enabled, allows remote malicious users to execute arbitrary code via the _self variable in a template.

Vulnerable Product	Search on Vulmon	Subscribe to Product
symfony twig

James Kettle, Alain Tiemblo, Christophe Coevoet and Fabien Potencier discovered that twig, a templating engine for PHP, did not correctly process its input End users allowed to submit twig templates could use specially crafted code to trigger remote code execution, even in sandboxed templates For the stable distribution (jessie), this problem has ...

CWE-264 http://openwall.com/lists/oss-security/2015/08/21/3 https://github.com/fabpot/Twig/commit/30be07759a3de2558da5224f127d052ecf492e8f https://github.com/twigphp/Twig/pull/1759 http://www.debian.org/security/2015/dsa-3343 http://openwall.com/lists/oss-security/2015/10/11/2 http://symfony.com/blog/security-release-twig-1-20-0 https://nvd.nist.gov https://www.debian.org/security/./dsa-3343

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-7809

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect