kritisch
CVE-2024-51736
CVE-2024-51736: Command execution hijack on Windows with Process class
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.6CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch).
Beschreibung
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| composer::GitHub Security Advisory Composer | symfony/process, symfony/symfony | 5.4.46, 6.4.14, 7.1.7 |
| composer::PHP Security Advisories Database | symfony/process, symfony/symfony | kein Fix angegeben |
Alle 4 Einträge aus 2 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| composer::GitHub Security Advisory Composer | symfony/process | 5.4.46, 6.4.14, 7.1.7 |
| composer::GitHub Security Advisory Composer | symfony/symfony | 5.4.46, 6.4.14, 7.1.7 |
| composer::PHP Security Advisories Database | symfony/process | kein Fix angegeben |
| composer::PHP Security Advisories Database | symfony/symfony | kein Fix angegeben |
Referenzen
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/process/CVE-2024-51736.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-51736.yaml
- https://github.com/symfony/symfony
- https://github.com/symfony/symfony/commit/18ecd03eda3917fdf901a48e72518f911c64a1c9
- https://github.com/symfony/symfony/security/advisories/GHSA-qq5c-677p-737q
- https://nvd.nist.gov/vuln/detail/CVE-2024-51736
- https://symfony.com/cve-2024-51736