critique
CVE-2024-51736
CVE-2024-51736: Command execution hijack on Windows with Process class
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.6CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (élevée).
Description
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| composer::GitHub Security Advisory Composer | symfony/process, symfony/symfony | 5.4.46, 6.4.14, 7.1.7 |
| composer::PHP Security Advisories Database | symfony/process, symfony/symfony | pas de correctif indiqué |
Afficher les 4 entrées de 2 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| composer::GitHub Security Advisory Composer | symfony/process | 5.4.46, 6.4.14, 7.1.7 |
| composer::GitHub Security Advisory Composer | symfony/symfony | 5.4.46, 6.4.14, 7.1.7 |
| composer::PHP Security Advisories Database | symfony/process | pas de correctif indiqué |
| composer::PHP Security Advisories Database | symfony/symfony | pas de correctif indiqué |
Références
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/process/CVE-2024-51736.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-51736.yaml
- https://github.com/symfony/symfony
- https://github.com/symfony/symfony/commit/18ecd03eda3917fdf901a48e72518f911c64a1c9
- https://github.com/symfony/symfony/security/advisories/GHSA-qq5c-677p-737q
- https://nvd.nist.gov/vuln/detail/CVE-2024-51736
- https://symfony.com/cve-2024-51736