CVE-2024-50340
HIGH NUCLEISymfony Runtime < 5.4.46 - Injection
Title source: ruleDescription
symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Exploits (1)
Nuclei Templates (1)
Symfony Profiler - Remote Access via Injected Arguments
HIGHVERIFIEDby DhiyaneshDK
FOFA:
body="<div id=\"symfony\">" || header="Set-Cookie: symfony"
Scores
CVSS v3
7.3
EPSS
0.8562
EPSS Percentile
99.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-74
Status
published
Products (5)
symfony/runtime
5.3.0 - 5.4.46Packagist
symfony/symfony
5.3.0 - 5.4.46Packagist
symfony/symfony
< 5.4.46
symfony/symfony
>= 6.0.0, < 6.4.14
symfony/symfony
>= 7.0.0, < 7.1.7
Published
Nov 06, 2024
Tracked Since
Feb 18, 2026