Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-50340

Good to know:

icon
icon

Date: November 6, 2024

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the "register_argv_argc" php directive is set to "on" , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the "SymfonyRuntime" now ignores the "argv" values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Language: PHP

Severity Score

Related Resources (8)

https://nvd.nist.gov/vuln/detail/CVE-2024-50340
https://github.com/symfony/symfony
https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j
https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/runtime/CVE-2024-50340.yaml
https://symfony.com/cve-2024-50340
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50340.yaml
https://www.mend.io/vulnerability-database/CVE-2024-50340

Severity Score

Weakness Type (CWE)

Input Validation

CWE-20

Injection

CWE-74

Top Fix

icon

Upgrade Version

Upgrade to version symfony/runtime - v5.4.46,v6.4.14,v7.1.7

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us