CVE-2024-50340

Katalog CVE

CVSS 7.3 · High EPSS 64,8%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). Skor CVSS 3.1 7.3 (High) menurut github.com.

Deskripsi (NVD)

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

6 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.3 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

64,8% peluang dieksploitasi; lebih tinggi dari 99,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa
• https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j