PT-2019-1920 · Twig+2 · Twig+2
Fabien Potencier
·
Publicado
2019-03-10
·
Atualizado
2023-03-13
·
CVE-2019-9942
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Twig versions prior to 1.38.0
Twig versions 2.x prior to 2.7.0
Description
A sandbox information disclosure issue exists because, under some circumstances, it is possible to call the
toString() method on an object even if not allowed by the security policy in place. This could allow a remote attacker to access confidential data.Recommendations
For Twig versions prior to 1.38.0, update to version 1.38.0 or later.
For Twig versions 2.x prior to 2.7.0, update to version 2.7.0 or later.
As a temporary workaround, consider restricting access to objects that could be exploited through the
toString() method until a patch is available.Exploit
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Linuxmint
Twig
Ubuntu