CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2018-13982
https://notcve.org/view.php?id=CVE-2018-13982
Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files. Smarty_Security::isTrustedResourceDir() en Smarty en versiones anteriores a la 3.1.33 es propenso a una vulnerabilidad de salto de directorio debido al saneamiento insuficiente de códigos de plantilla. Esto permite que los atacantes que controlan el código de plantilla ejecutado omitan las restricciones de seguridad del directorio de confianza y lean archivos arbitrarios. • https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180420-01_Smarty_Path_Traversal https://github.com/smarty-php/smarty/commit/2e081a51b1effddb23f87952959139ac62654d50 https://github.com/smarty-php/smarty/commit/8d21f38dc35c4cd6b31c2f23fc9b8e5adbc56dfe https://github.com/smarty-php/smarty/commit/bcedfd6b58bed4a7366336979ebaa5a240581531 https://github.com/smarty-php/smarty/commit/c9dbe1d08c081912d02bd851d1d1b6388f6133d1 https://github.com/smarty-php/smarty/commit/f9ca3c63d1250bb56b2bda609dcc9dd81f0065f8 https://lists.debian.org/debian-lts&# • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-16831
https://notcve.org/view.php?id=CVE-2018-16831
Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in an include statement. Smarty en versiones anteriores a la 3.1.33-dev-4 permite que los atacantes omitan el mecanismo de protección trusted_dir mediante una subcadena file:./../ en una instrucción include. • https://github.com/smarty-php/smarty/issues/486 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000480
https://notcve.org/view.php?id=CVE-2017-1000480
Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name. Smarty 3, en versiones anteriores a la 3.1.32, es vulnerable a una inyección de código PHP al llamar a las funciones fetch() o display() en recursos personalizados que no sanean el nombre de la plantilla. • https://github.com/smarty-php/smarty/blob/master/change_log.txt https://lists.debian.org/debian-lts-announce/2018/01/msg00023.html https://lists.debian.org/debian-lts-announce/2018/02/msg00000.html https://www.debian.org/security/2018/dsa-4094 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 4%CPEs: 100EXPL: 3CVE-2014-8350
https://notcve.org/view.php?id=CVE-2014-8350
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template. Smarty anterior a 3.1.21 permite a atacantes remotos evadir las restricciones del modo seguro y ejecutar código PHP arbitrario tal y como fue demostrado por '{literal}<{/literal}script language=php>' en una plantilla. • http://advisories.mageia.org/MGASA-2014-0468.html http://seclists.org/oss-sec/2014/q4/420 http://seclists.org/oss-sec/2014/q4/421 http://www.mandriva.com/security/advisories?name=MDVSA-2014:221 http://www.securityfocus.com/bid/70708 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765920 https://code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt?r=4902 https://exchange.xforce.ibmcloud.com/vulnerabilities/97725 • CWE-94: Improper Control of Generation of Code ('Code Injection') •