CVE-2024-51736

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Nov 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-517377.0RediSearch is a Redis module that provides querying, secondary indexing, and full-text search for Redis. An authenticated redis user executi CVE-2024-517388.1Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validat CVE-2024-517395.3Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier CVE-2024-51745.3A flaw in Gliffy results in broken authentication through the reset functionality of the application.CVE-2024-517408.8Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the serv CVE-2024-517414.4Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL se CVE-2024-517438.8MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulne CVE-2024-517443.1golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation CVE-2024-5174510.0Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special devi CVE-2024-517461.8Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry t CVE-2024-517477.2Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrar CVE-2024-517487.2Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code o