nvd.nist.gov
Open in
urlscan Pro
2600:1f18:268d:1ddd:fd96:dcaa:cf17:f2b2
Public Scan
Submitted URL: http://dlvr.it/SZ8jx1
Effective URL: https://nvd.nist.gov/vuln/detail/CVE-2022-39261
Submission: On October 06 via manual from CA — Scanned from IT
Effective URL: https://nvd.nist.gov/vuln/detail/CVE-2022-39261
Submission: On October 06 via manual from CA — Scanned from IT
Form analysis 0 forms found in the DOM
Text Content
YOU ARE VIEWING THIS PAGE IN AN UNAUTHORIZED FRAME WINDOW.
This is a potential security issue, you are being redirected to
https://nvd.nist.gov
You have JavaScript disabled. This site requires JavaScript to be enabled for
complete site functionality.
An official website of the United States government Here's how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United
States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share
sensitive information only on official, secure websites.
NVD MENU
* General Expand or Collapse
NVD Dashboard
News
Email List
FAQ
Visualizations
* Vulnerabilities Expand or Collapse
Search & Statistics
Full Listing
Weakness Types
Legacy Data Feeds
Vendor Comments
CVMAP
* Vulnerability Metrics Expand or Collapse
CVSS V3 Calculator
CVSS V2 Calculator
* Products Expand or Collapse
CPE Dictionary
CPE Search
CPE Statistics
SWID
* Developers Expand or Collapse
Start Here
Request an API Key
Vulnerabilities
Products
Data Sources
Terms of Use
* Contact NVD
* Other Sites Expand or Collapse
Checklist (NCP) Repository
Configurations (CCE)
800-53 Controls
SCAP Validated Tools
SCAP
USGCB
* Search Expand or Collapse
Vulnerability Search
CPE Search
INFORMATION TECHNOLOGY LABORATORY
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NVD
1. Vulnerabilities
CVE-2022-39261 DETAIL
CURRENT DESCRIPTION
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to
2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader
loads templates for which the name is a user input. It is possible to use the
`source` or `include` statement to read arbitrary files from outside the
templates' directory when using a namespace like `@somewhere/../some.file`. In
such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain
a fix for validation of such template names. There are no known workarounds
aside from upgrading.
View Analysis Description
ANALYSIS DESCRIPTION
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to
2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader
loads templates for which the name is a user input. It is possible to use the
`source` or `include` statement to read arbitrary files from outside the
templates' directory when using a namespace like `@somewhere/../some.file`. In
such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain
a fix for validation of such template names. There are no known workarounds
aside from upgrading.
SEVERITY
CVSS Version 3.x CVSS Version 2.0
CVSS 3.x Severity and Metrics:
CNA: GitHub, Inc.
Base Score: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD Analysts use publicly available information to associate vector strings and
CVSS scores. We also display any CVSS information provided within the CVE List
from the CNA.
Note: The NVD and the CNA have provided the same score. When this occurs only
the CNA information is displayed, but the Acceptance Level icon for the CNA is
given a checkmark to signify NVD concurrence.
CVSS 2.0 Severity and Metrics:
NIST: NVD
Base Score: N/A
NVD score not yet provided.
NVD Analysts use publicly available information to associate vector strings and
CVSS scores. We also display any CVSS information provided within the CVE List
from the CNA.
Note: NVD Analysts have not published a CVSS score for this CVE at this time.
NVD Analysts use publicly available information at the time of analysis to
associate CVSS vector strings.
REFERENCES TO ADVISORIES, SOLUTIONS, AND TOOLS
By selecting these links, you will be leaving NIST webspace. We have provided
these links to other web sites because they may have information that would be
of interest to you. No inferences should be drawn on account of other sites
being referenced, or not, from this page. There may be other web sites that are
more appropriate for your purpose. NIST does not necessarily endorse the views
expressed, or concur with the facts presented on these sites. Further, NIST does
not endorse any commercial products that may be mentioned on these sites. Please
address comments about this page to nvd@nist.gov.
Hyperlink Resource
https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b
Patch Third Party Advisory
https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33 Third
Party Advisory https://www.drupal.org/sa-core-2022-016 Patch Third Party
Advisory
WEAKNESS ENUMERATION
CWE-ID CWE Name Source CWE-22 Improper Limitation of a Pathname to a Restricted
Directory ('Path Traversal') GitHub, Inc.
KNOWN AFFECTED SOFTWARE CONFIGURATIONS SWITCH TO CPE 2.2
CPES LOADING, PLEASE WAIT.
Configuration 1 ( hide )
cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*
Show Matching CPE(s) From (including)
1.0.0Up to (excluding)
1.44.7 cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*
Show Matching CPE(s) From (including)
2.0.0Up to (excluding)
2.15.3 cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*
Show Matching CPE(s) From (including)
3.0.0Up to (excluding)
3.4.3
Configuration 2 ( hide )
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Show Matching CPE(s) From (including)
8.0.0Up to (excluding)
9.3.22 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Show Matching CPE(s) From (including)
9.4.0Up to (excluding)
9.4.7
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
CHANGE HISTORY
2 change records found show changes
INITIAL ANALYSIS 9/30/2022 3:58:28 PM
Action Type Old Value New Value Added CPE Configuration
OR
*cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.0.0 up to (excluding) 9.3.22
*cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 9.4.0 up to (excluding) 9.4.7
Added CPE Configuration
OR
*cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* versions from (including) 1.0.0 up to (excluding) 1.44.7
*cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* versions from (including) 2.0.0 up to (excluding) 2.15.3
*cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.4.3
Added CVSS V3.1
NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Changed Reference Type
https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b No Types Assigned
https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b Patch, Third Party Advisory
Changed Reference Type
https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33 No Types Assigned
https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33 Third Party Advisory
Changed Reference Type
https://www.drupal.org/sa-core-2022-016 No Types Assigned
https://www.drupal.org/sa-core-2022-016 Patch, Third Party Advisory
CVE MODIFIED BY GITHUB, INC. 9/28/2022 4:15:17 PM
Action Type Old Value New Value Added Reference
https://www.drupal.org/sa-core-2022-016 [No Types Assigned]
QUICK INFO
CVE Dictionary Entry:
CVE-2022-39261
NVD Published Date:
09/28/2022
NVD Last Modified:
09/30/2022
Source:
GitHub, Inc.
* twitter (link is external)
* facebook (link is external)
* linkedin (link is external)
* youtube (link is external)
* rss
* govdelivery (link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
(301) 975-2000
Webmaster | Contact Us | Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email: soc@us-cert.gov
Phone: 1-888-282-0870
Sponsored by
CISA
Site Privacy | Accessibility | Privacy Program | Copyrights | Vulnerability
Disclosure | No Fear Act Policy | FOIA | Environmental Policy | Scientific
Integrity | Information Quality Standards | Commerce.gov | Science.gov | USA.gov