GitHub Advisoryadvisory · Packagist

GHSA-4h9c-v5vg-5m6m Access to restricted PHP code by dynamic static class access in smarty

HIGH Published 2022-01-12 Modified 2022-01-20 Official page ↗
Aliases
CVE-2021-21408
Ecosystem
Packagist
Packages
smarty/smarty
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2022-01-10

Affected packages

• Packagist smarty/smarty: < 3.1.43 → fixed in 3.1.43 • Packagist smarty/smarty: >= 4.0.0, < 4.0.3 → fixed in 4.0.3

Description

Impact Template authors could run restricted static php methods. Patches Please upgrade to 3.1.40 or higher. References See the documentation on Smarty security features on the static_classes access filter. For more information If you have any questions or comments about this advisory please open an issue in the Smarty repo

Related

Alias · CVE (1)

  • CVE-2021-21408 Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References