CVE-2019-9942

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077Patch, Third Party Advisory
https://seclists.org/bugtraq/2019/Mar/60Mailing List, Third Party Advisory
https://symfony.com/blog/twig-sandbox-information-disclosurePatch, Vendor Advisory
https://www.debian.org/security/2019/dsa-4419Third Party Advisory
https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077Patch, Third Party Advisory
https://seclists.org/bugtraq/2019/Mar/60Mailing List, Third Party Advisory
https://symfony.com/blog/twig-sandbox-information-disclosurePatch, Vendor Advisory
https://www.debian.org/security/2019/dsa-4419Third Party Advisory

Timeline

Published: Mar 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-99437.5In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO.server 5.1.0 through 5.6.0, permissions on OMER CVE-2019-99447.5In Open Microscopy Environment OMERO.server 5.0.0 through 5.6.0, the reading of files from imported image filesets may circumvent OMERO perm CVE-2019-99459.8SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a us CVE-2019-99467.5Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Ku CVE-2019-99476.1An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the at CVE-2019-99489.1urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechani CVE-2019-99498.8Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affec CVE-2019-99509.8Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My C CVE-2019-99519.8Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My C CVE-2019-99556.1On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN,CVE-2019-99568.8In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to CVE-2019-99575.4Stored XSS within Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to execute malicious JavaScript and inject arbitrar