GitHub Advisoryadvisory · Packagist

GHSA-29gp-2c3m-3j6m Sandbox Escape by math function in smarty

HIGH Published 2022-01-12 Modified 2022-01-20 Official page ↗
Aliases
CVE-2021-29454
Ecosystem
Packagist
Packages
smarty/smarty
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-74
Reviewed
2022-01-10

Affected packages

• Packagist smarty/smarty: < 3.1.42 → fixed in 3.1.42 • Packagist smarty/smarty: >= 4.0.0, < 4.0.2 → fixed in 4.0.2

Description

Impact Template authors could run arbitrary PHP code by crafting a malicious math string. If a math string is passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Patches Please upgrade to 4.0.2 or 3.1.42 or higher. References See documentation on Math function. For more information If you have any questions or comments about this advisory please open an issue in the Smarty repo

Related

Alias · CVE (1)

  • CVE-2021-29454 Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References