CVE-2021-29454 Information

Description

Smarty is a template engine for PHP facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2 template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

https://github.com/smarty-php/smarty/commit/215d81a9fa3cd63d82fb3ab56ecaf97cf1e7db71 https://github.com/smarty-php/smarty/security/advisories/GHSA-29gp-2c3m-3j6m https://packagist.org/packages/smarty/smarty https://github.com/smarty-php/smarty/releases/tag/v3.1.42 https://www.smarty.net/docs/en/language.function.math.tpl https://github.com/smarty-php/smarty/releases/tag/v4.0.2 https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html https://www.debian.org/security/2022/dsa-5151

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8