CVE-2024-50340
📛 CVE Title
Ability to change environment from query in symfony/runtime
Description
symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- GitHub_M
- CVSS severity
- HIGH
- CVSS score
- 7.3 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L- Effective score
- 7.3 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-74 - Reserved
- 2024-10-22
- Published
- 2024-11-06 22:09 UTC
- Last updated
- 2024-11-07 16:29 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50340.json
- Linked Threat
- CVE-2024-50340 — Ability to change environment from query in symfony/runtime
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2024-3330 - Assigner
- GitHub_M
- Published
- Nov 6, 2024, 9:09:46 PM
- Updated
- Nov 7, 2024, 3:29:50 PM
- EUVD base score (CVSS 3.1)
-
7.3 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - EUVD-reported EPSS
- 85.0500
- Vendors
- symfony
- Products
-
symfony (< 5.4.46)symfony (6.0.0, < 6.4.14)symfony (7.0.0, < 7.1.7)
- Aliases
-
GHSA-x8vp-gf4q-mw5j
ENISA description: symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| symfony | symfony |
< 5.4.46 (affected),
>= 6.0.0, < 6.4.14 (affected),
>= 7.0.0, < 7.1.7 (affected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (4)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- http://cwe.mitre.org/data/definitions/74.html rapid7:cwe.mitre.org
- https://attackerkb.com/topics/CVE-2024-50340 rapid7:attackerkb.com
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3330 rapid7:euvd.enisa.europa.eu
- https://www.cve.org/CVERecord?id=CVE-2024-50340 rapid7:www.cve.org
Remediations (16)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.nollium.com
CVE-2024-50340 is a critical vulnerability (CVSS: 7.3) affecting Symfony applications when the PHP directive register_argc_argv is enabled. By appending ?+--env=dev to a URL, attackers can force the application into the dev environment, granting remote access to the Symfony profiler.
2026-08-05 18:28 UTC -
web:cvefeed.io
The following list is the news that have been mention CVE-2024-50340 vulnerability anywhere in the article. Results are limited to the first 20 news articles due to potential performance issues. The following table lists the changes that have been made to the CVE-2024-50340 vulnerability over time.
2026-08-05 18:28 UTC -
web:www.microsoft.com
Help protect your computing environment by keeping up to date on Microsoft technical security notifications. Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed. You can choose the type of ...
2026-08-05 18:28 UTC -
web:www.nist.gov
NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.
2026-08-05 18:28 UTC -
web:helpx.adobe.com
This page contains important information regarding security vulnerabilities that could affect specific versions of Adobe products. Use this information to take the prescribed corrective actions.
2026-08-05 18:28 UTC -
web:app.opencve.io
Remediation No vendor fix or workaround currently provided. OpenCVE Recommended Actions Apply the Microsoft security update for CVE -2026- 50340 from the Microsoft Security Update Guide. Restrict network access to the vulnerable components or isolate unpatched systems from untrusted networks until the patch is applied.
2026-08-05 18:28 UTC -
web:symfony.com
Resolution The SymfonyRuntime now ignores the argv values for non-cli SAPIs PHP runtimes The patch for this issue is available here for branch 5.4. Credits We would like to thank Vladimir Dusheyko for reporting the issue and Wouter de Jong for providing the fix .
2026-05-22 10:40 UTC -
web:ubuntu.com
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use. Get Ubuntu Pro 30-day free trial
2026-05-22 10:40 UTC -
web:www.cvedetails.com
CVE-2024-50340 : symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc`
2026-05-22 10:40 UTC -
web:www.sentinelone.com
CVE-2024-50340 is a remote code execution vulnerability in Symfony Runtime. Learn about its impact, affected versions, and mitigation methods.
2026-05-22 10:40 UTC -
web:www.tenable.com
symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the ...
2026-05-22 10:40 UTC -
web:cisa.gov
Update (08/12/2025): CISA has updated this alert to provide clarification on identifying Exchange Servers on an organization's networks and provided further guidance on running the Microsoft Exchange Health Checker. Update (08/07/2025): CISA issued Emergency Directive (ED) 25-02: Mitigate Microsoft Exchange Vulnerability in response to CVE -2025-53786
2026-05-22 10:40 UTC -
web:feedly.com
Nov 6, 2024 at 4:50 AM Threat Intelligence Report CVE-2024-50340 is a medium-risk vulnerability with four associated vulnerabilities, for which a patch is available. There is no information provided regarding its exploitation in the wild, proof-of-concept exploits, or any downstream impacts on third-party vendors or technology.
2026-05-22 10:40 UTC -
web:gbhackers.com
Microsoft has released its September 2025 Patch Tuesday update, addressing a total of 81 security vulnerabilities across its product portfolio.
2026-05-22 10:40 UTC -
web:nvd.nist.gov
An official website of the United States government Here's how you know
2026-05-22 10:40 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 10:40 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2024-50340.json.
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "symfony",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "5.4.46",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.4.14",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.7",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-50340",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-07T15:27:34.309967Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-07T15:29:50.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "symfony",
"vendor": "symfony",
"versions": [
{
"status": "affected",
"version": "< 5.4.46"
},
{
"status": "affected",
"version": ">= 6.0.0, < 6.4.14"
},
{
"status": "affected",
"version": ">= 7.0.0, < 7.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T21:09:46.750Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j"
},
{
"name": "https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa"
}
],
"source": {
"advisory": "GHSA-x8vp-gf4q-mw5j",
"discovery": "UNKNOWN"
},
"title": "Ability to change environment from query in symfony/runtime"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-50340",
"datePublished": "2024-11-06T21:09:46.750Z",
"dateReserved": "2024-10-22T17:54:40.955Z",
"dateUpdated": "2024-11-07T15:29:50.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}