CVE-2022-23614

symfony twig, fedoraproject fedora, debian linux

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-23614

Katalog CVE

CVSS 9.8 · Critical EPSS 8,2%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada symfony twig, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.

Rincian

Terbit di NVD
4 Februari 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari)
8,2% peluang dieksploitasi; lebih tinggi dari 94,7% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
symfony twig Versi 2.0.0 hingga sebelum 2.14.11
symfony twig Versi 3.0.0 hingga sebelum 3.3.8
fedoraproject fedora Versi 34
fedoraproject fedora Versi 35
debian debian linux Versi 11.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.