CVE-2024-51736

published 2024-11-06

CVE-2024-51736: Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is…

Priority P3 53 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
debian	symfony	—	—
sensiolabs	symfony	< 5.4.46	5.4.46
sensiolabs	symfony	>= 6.0.0 < 6.4.14	6.4.14
sensiolabs	symfony	>= 7.0.0 < 7.1.7	7.1.7
symfony	process	>= 0 < 5.4.46	5.4.46
symfony	process	>= 6.0.0 < 6.4.14	6.4.14
symfony	process	>= 7.0.0 < 7.1.7	7.1.7
symfony	symfony	< 5.4.46	5.4.46
symfony	symfony	—	—
symfony	symfony	—	—
symfony	symfony	>= 0 < 5.4.46	5.4.46
symfony	symfony	>= 6.0.0 < 6.4.14	6.4.14
symfony	symfony	>= 7.0.0 < 7.1.7	7.1.7

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vendor_debian 9.8 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77