CVE-2024-45411

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-454127.5Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled CVE-2024-454138.1The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. This function is an API wr CVE-2024-454149.8The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is res CVE-2024-454159.8The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is CVE-2024-454168.1The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stor CVE-2024-454175.5Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct CVE-2024-454188.8Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalatio CVE-2024-454197.5Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2024-454206.5Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via CVE-2024-454218.8Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.CVE-2024-454227.5Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via networ CVE-2024-454247.5Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access