crítica
CVE-2024-51736
CVE-2024-51736: Command execution hijack on Windows with Process class
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.6CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta).
Descripción
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| composer::GitHub Security Advisory Composer | symfony/process, symfony/symfony | 5.4.46, 6.4.14, 7.1.7 |
| composer::PHP Security Advisories Database | symfony/process, symfony/symfony | sin corrección indicada |
Mostrar las 4 entradas de 2 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| composer::GitHub Security Advisory Composer | symfony/process | 5.4.46, 6.4.14, 7.1.7 |
| composer::GitHub Security Advisory Composer | symfony/symfony | 5.4.46, 6.4.14, 7.1.7 |
| composer::PHP Security Advisories Database | symfony/process | sin corrección indicada |
| composer::PHP Security Advisories Database | symfony/symfony | sin corrección indicada |
Referencias
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/process/CVE-2024-51736.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-51736.yaml
- https://github.com/symfony/symfony
- https://github.com/symfony/symfony/commit/18ecd03eda3917fdf901a48e72518f911c64a1c9
- https://github.com/symfony/symfony/security/advisories/GHSA-qq5c-677p-737q
- https://nvd.nist.gov/vuln/detail/CVE-2024-51736
- https://symfony.com/cve-2024-51736