CVE-2021-21408 Information

Description

Smarty is a template engine for PHP facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3 template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

https://github.com/smarty-php/smarty/commit/19ae410bf56007a5ef24441cdc6414619cfaf664 https://github.com/smarty-php/smarty/releases/tag/v3.1.43 https://github.com/smarty-php/smarty/security/advisories/GHSA-4h9c-v5vg-5m6m https://github.com/smarty-php/smarty/releases/tag/v4.0.3 https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html https://www.debian.org/security/2022/dsa-5151

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8