QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2022-23614

Back to search

CVE-2022-23614

Published: Feb 4, 2022

Modified: Apr 23, 2025

PUBLISHED

CVSS v3.1

8.8

HIGH

Description

Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.

VendorProductVersions

twigphp

Twig

affected
>= 3.0.0, < 3.3.8
affected
>= 2.0.0, < 2.14.11

Weaknesses (CWE)

CWE-74

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

FEDORA-2022-167b9becef
vendor-advisory
x_refsource_FEDORA
FEDORA-2022-47293b1d23
vendor-advisory
x_refsource_FEDORA
FEDORA-2022-7d871d7583
vendor-advisory
x_refsource_FEDORA
FEDORA-2022-58abb323f0
vendor-advisory
x_refsource_FEDORA
DSA-5107
vendor-advisory
x_refsource_DEBIAN

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now