Vulnerability in Symfony Twig
CVE-2015-7809
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.034 (88.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 88.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.034 · newest: 0.034 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/twigphp/Twig/pull/1759
- www.debian.org/security/2015/dsa-3343 (vendor-advisory)
- symfony.com/blog/security-release-twig-1-20-0 (Vendor Advisory)
- github.com/fabpot/Twig/commit/30be07759a3de2558da5224f127d052ecf492e8f
- openwall.com/lists/oss-security/2015/10/11/2 (mailing-list)
- openwall.com/lists/oss-security/2015/08/21/3 (mailing-list)