Home > Vulnerability Database > CVE-2024-51736

Mend.io Vulnerability Database

CVE-2024-51736

Good to know:

Date: November 6, 2024

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named "cmd.exe" is located in the current working directory it will be called by the "Process" class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Language: PHP

Severity Score

0.0

Related Resources (8)

Url: https://github.com/symfony/symfony

Url: https://symfony.com/cve-2024-51736

Url: https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-51736.yaml

Url: https://github.com/symfony/symfony/security/advisories/GHSA-qq5c-677p-737q

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-51736

Url: https://github.com/symfony/symfony/commit/18ecd03eda3917fdf901a48e72518f911c64a1c9

Url: https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/process/CVE-2024-51736.yaml

Url: https://www.mend.io/vulnerability-database/CVE-2024-51736

Weakness Type (CWE)

Command Injection

CWE-77

Top Fix

Upgrade Version

Upgrade to version symfony/process - v5.4.46,v6.4.14,v7.1.7

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE