{"id":"CVE-2024-51755","published":"2024-11-06T19:27:05Z","modified":"2024-11-07T15:12:59Z","title":"Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig","vendor":"twigphp","product":"Twig","tier":"tail","description":{"text":"Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":2.2,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00425,"percentile":0.36831,"provenance":"source"},"cwes":[{"id":"CWE-668","name":"Exposure of Resource to Wrong Sphere"}],"references":[{"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-jjxq-ff2g-95vh","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/twigphp/Twig/commit/831c148e786178e5f2fde9db67266be3bf241c21","tags":["x_refsource_MISC"]}],"priority":{"score":8.9,"factors":[{"name":"EPSS percentile","points":7.37},{"name":"CVSS severity","points":1.54}]},"vendorSlug":"twigphp","affectedVersions":[{"vendor":"twigphp","product":"Twig","versions":["< 3.11.2",">= 3.12.0, < 3.14.1"]}],"affected":[{"ecosystem":"Packagist","package":"twig/twig","vulnerableRanges":["<3.11.2",">=3.12, <3.14.1"],"patched":["3.11.2","3.14.1"],"from":["GHSA-jjxq-ff2g-95vh"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3273","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-twigphp-twig-cve-2022-23614","parents":[{"from":"CVE-2024-45411","to":"CVE-2024-51755","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:twig/twig","fromFixed":"3.11.1","toFixed":"3.11.2","daysApart":58},{"kind":"same-code","provenance":"machine","files":["src/Extension/CoreExtension.php"],"commits":["https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6","https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de","https://github.com/twigphp/Twig/commit/831c148e786178e5f2fde9db67266be3bf241c21"],"basis":"rarely changed file"}]},{"from":"CVE-2022-23614","to":"CVE-2024-51755","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Extension/CoreExtension.php"],"commits":["https://github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9","https://github.com/twigphp/Twig/commit/2eb33080558611201b55079d07ac88f207b466d5","https://github.com/twigphp/Twig/commit/831c148e786178e5f2fde9db67266be3bf241c21"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-39261","published":"2022-09-28","fixed":"3.4.3","kev":false},{"cve":"CVE-2024-45411","published":"2024-09-09","fixed":"3.14.0","kev":false},{"cve":"CVE-2024-51754","published":"2024-11-06","fixed":"3.14.1","kev":false},{"cve":"CVE-2024-51755","published":"2024-11-06","fixed":"3.14.1","kev":false},{"cve":"CVE-2025-24374","published":"2025-01-29","fixed":"3.19.0","kev":false},{"cve":"CVE-2026-24425","published":"2026-05-20","fixed":"3.26.0","kev":false},{"cve":"CVE-2026-46628","published":"2026-07-14","fixed":"3.26.0","kev":false}],"package":"Packagist:twig/twig"}}