Command Hijacking

🗓️ 19 Nov 2024 11:39:17Reported by Veracode Vulnerability DatabaseType

Symfony is vulnerable to Command Hijacking due to insecure executable file handling by Process class.

Reporter	Title	Published	Views	Family All 18
Circl	CVE-2024-51736	6 Nov 202420:53	–	circl
CNNVD	Symfony 命令注入漏洞	6 Nov 202400:00	–	cnnvd
CVE	CVE-2024-51736	6 Nov 202420:51	–	cve
Cvelist	CVE-2024-51736 Command execution hijack on Windows with Process class in symfony/process	6 Nov 202420:51	–	cvelist
Debian CVE	CVE-2024-51736	6 Nov 202420:51	–	debiancve
EUVD	EUVD-2024-3302	3 Oct 202520:07	–	euvd
Friends Of PHP	CVE-2024-51736: Command execution hijack on Windows with Process class	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	CVE-2024-51736: Command execution hijack on Windows with Process class	1 Jan 197000:00	–	friendsofphp
Github Security Blog	Symfony vulnerable to command execution hijack on Windows with Process class	6 Nov 202415:22	–	github
NVD	CVE-2024-51736	6 Nov 202421:15	–	nvd

Vulners

Node

process symfony/processRange2.0.x-dev–5.4.45php

process symfony/processRangev6.0.0-BETA1–6.0.0-BETA1php

process symfony/processRangev7.0.0-BETA1–7.0.0-BETA1php

symfony symfony/symfonyRangev2.0.0BETA1–2.0.0BETA1php

symfony symfony/symfonyRangev6.0.0-BETA1–6.0.0-BETA1php

symfony symfony/symfonyRangev7.0.0-BETA1–7.0.0-BETA1php

Source	Link
github	www.github.com/symfony/symfony/commit/18ecd03eda3917fdf901a48e72518f911c64a1c9
symfony	www.symfony.com/blog/cve-2024-51736-command-execution-hijack-on-windows-with-process-class
github	www.github.com/advisories/GHSA-qq5c-677p-737q
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-51736.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/process/CVE-2024-51736.yaml

21 Nov 2024 11:28Current

7.5High risk

Vulners AI Score7.5

CVSS 3.19.8

EPSS0.00783

SSVC