Fluid Attacks Database

Description

Twig Sandbox Information Disclosure A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	twig/twig	>=0 <1.38.0 \|\| >=2.0.0 <2.7.0	1.38.0, 2.7.0

Aliases

1. CVE-2019-99422. NVD-2019-99423. OSV-2019-99424. GCVE-2019-9942

References

1. https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f05020772. https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2019-9942.yaml3. https://seclists.org/bugtraq/2019/Mar/604. https://symfony.com/blog/twig-sandbox-information-disclosure5. https://www.debian.org/security/2019/dsa-4419