CVE-2022-23614

HIGH8.8EPSS 21.1%

Code injection in Twig

發布日:2022/2/10修改日:2024/2/16
也稱為:GHSA-5mv2-rx3q-4w2v

描述

# Description When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. # Resolution We now disallow calling non Closure in the `sort` filter like we already did for some other filters. # Credits We would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.

受影響套件(3)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1HIGH8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

參考連結(13)