CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-29454 – Sandbox Escape by math function in smarty
https://notcve.org/view.php?id=CVE-2021-29454
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch. Smarty es un motor de plantillas para PHP que facilita la separación de la presentación (HTML/CSS) de la lógica de la aplicación. • https://github.com/smarty-php/smarty/commit/215d81a9fa3cd63d82fb3ab56ecaf97cf1e7db71 https://github.com/smarty-php/smarty/releases/tag/v3.1.42 https://github.com/smarty-php/smarty/releases/tag/v4.0.2 https://github.com/smarty-php/smarty/security/advisories/GHSA-29gp-2c3m-3j6m https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ https://lists.fedoraproject.org/archives/l • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2021-26120
https://notcve.org/view.php?id=CVE-2021-26120
Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring. Smarty versiones anteriores a 3.1.39, permite una inyección de código por medio de un nombre de función no previsto después de una subcadena {function name= • https://github.com/smarty-php/smarty/blob/master/CHANGELOG.md https://lists.debian.org/debian-lts-announce/2021/04/msg00004.html https://lists.debian.org/debian-lts-announce/2021/04/msg00014.html https://security.gentoo.org/glsa/202105-06 https://www.debian.org/security/2022/dsa-5151 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-26119
https://notcve.org/view.php?id=CVE-2021-26119
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode. Smarty versiones anteriores a 3.1.39, permite un Escape del Sandbox porque un $smarty.template_object puede ser accedido en el modo sandbox • https://github.com/smarty-php/smarty/blob/master/CHANGELOG.md https://lists.debian.org/debian-lts-announce/2021/04/msg00004.html https://lists.debian.org/debian-lts-announce/2021/04/msg00014.html https://security.gentoo.org/glsa/202105-06 https://www.debian.org/security/2022/dsa-5151 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-10375
https://notcve.org/view.php?id=CVE-2020-10375
An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product. Se detectó un problema en New Media Smarty versiones anteriores a 9.10. • https://www.smarty-online.de https://www.x41-dsec.de/lab/advisories/x41-2020-005-smarty • CWE-326: Inadequate Encryption Strength •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2018-13982
https://notcve.org/view.php?id=CVE-2018-13982
Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files. Smarty_Security::isTrustedResourceDir() en Smarty en versiones anteriores a la 3.1.33 es propenso a una vulnerabilidad de salto de directorio debido al saneamiento insuficiente de códigos de plantilla. Esto permite que los atacantes que controlan el código de plantilla ejecutado omitan las restricciones de seguridad del directorio de confianza y lean archivos arbitrarios. • https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180420-01_Smarty_Path_Traversal https://github.com/smarty-php/smarty/commit/2e081a51b1effddb23f87952959139ac62654d50 https://github.com/smarty-php/smarty/commit/8d21f38dc35c4cd6b31c2f23fc9b8e5adbc56dfe https://github.com/smarty-php/smarty/commit/bcedfd6b58bed4a7366336979ebaa5a240581531 https://github.com/smarty-php/smarty/commit/c9dbe1d08c081912d02bd851d1d1b6388f6133d1 https://github.com/smarty-php/smarty/commit/f9ca3c63d1250bb56b2bda609dcc9dd81f0065f8 https://lists.debian.org/debian-lts&# • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •