{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-04-01T07:06:07.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://symfony.com/blog/twig-sandbox-information-disclosure"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077"}, {"name": "DSA-4419", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2019/dsa-4419"}, {"name": "20190331 [SECURITY] [DSA 4419-1] twig security update", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "https://seclists.org/bugtraq/2019/Mar/60"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-9942", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://symfony.com/blog/twig-sandbox-information-disclosure", "refsource": "MISC", "url": "https://symfony.com/blog/twig-sandbox-information-disclosure"}, {"name": "https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077", "refsource": "MISC", "url": "https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077"}, {"name": "DSA-4419", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4419"}, {"name": "20190331 [SECURITY] [DSA 4419-1] twig security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Mar/60"}]}}, "x_gcve": [{"vulnId": "CVE-2019-9942", "recordType": "advisory"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:10:08.258Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://symfony.com/blog/twig-sandbox-information-disclosure"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077"}, {"name": "DSA-4419", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2019/dsa-4419"}, {"name": "20190331 [SECURITY] [DSA 4419-1] twig security update", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "https://seclists.org/bugtraq/2019/Mar/60"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-9942", "datePublished": "2019-03-23T14:31:53.000Z", "dateReserved": "2019-03-23T00:00:00.000Z", "dateUpdated": "2024-08-04T22:10:08.258Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2019-9942", "date": "2026-11-13", "epss": "0.01405", "percentile": "0.72994"}, "nvd": "{\"cve\":{\"id\":\"CVE-2019-9942\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-03-23T15:29:00.323\",\"lastModified\":\"2024-11-21T04:52:38.353\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.\"},{\"lang\":\"es\",\"value\":\"Existe una divulgaci\u00f3n de informaci\u00f3n del sandbox en Twig, en versiones anteriores a la 1.38.0 y versiones 2.x anteriores a la 2.7.0 ya que, en ciertas circunstancias, es posible llamar al m\u00e9todo __toString() en un objeto incluso aunque la pol\u00edtica de seguridad existente no lo permita.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.38.0\",\"matchCriteriaId\":\"29E9248A-7F3C-4A93-B5AE-A6DFCF8F82FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.7.0\",\"matchCriteriaId\":\"093B7610-57EF-4AB9-837E-1468E6F47052\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]}],\"references\":[{\"url\":\"https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/Mar/60\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://symfony.com/blog/twig-sandbox-information-disclosure\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.debian.org/security/2019/dsa-4419\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/Mar/60\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://symfony.com/blog/twig-sandbox-information-disclosure\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.debian.org/security/2019/dsa-4419\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}", "redhat_vex": {"current_release_date": "2025-11-21T17:09:05+00:00", "cve": "CVE-2019-9942", "id": "CVE-2019-9942", "initial_release_date": "2019-03-12T00:00:00+00:00", "product_status:known_not_affected": "1", "source": "Red Hat CSAF VEX", "status": "final", "title": "php-twig: sandbox information disclosure", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-9942.json", "version": "3"}}}