CVE-2022-39261
Twig may load a template outside a configured directory when using the filesystem loader
HIGH 7.5
En bref
- Source
- NVD
- EPSS
- EPSS 3.17 % · centile 88 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Modified
Description
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
Références
- https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33
- https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b
- https://www.drupal.org/sa-core-2022-016
- https://www.debian.org/security/2022/dsa-5248
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/
- https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- DRUPAL-CORE-2022-016 — Drupal uses the [Twig](https://twig.symfony.com/) third-party library for content templating and sanitization. [Twig has released a security update](https://sym
- GHSA-52m2-vc4m-jj33 — Twig may load a template outside a configured directory when using the filesystem loader
Références européennes
- ENISA EUVD · EUVD-2022-6700
- GCVE · GCVE-0-2022-39261
Avis du CERT-FR
- CERTFR-2022-AVI-866 — Vulnérabilité dans Drupal core · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*≥ 1.0.0 < 1.44.7cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*≥ 2.0.0 < 2.15.3cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.4.3cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.0.0 < 9.3.22cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 9.4.0 < 9.4.7cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| twigphp · Twig | affected => 1.0.0, < 1.44.7 ; affected >= 2.0.0, < 2.15.3 ; affected >= 3.0.0, < 3.4.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |