GitHub Advisoryadvisory · Packagist

GHSA-6m9f-8vwq-97pm Smarty Does Not Consider Umask Values When Setting Permissions

MEDIUM Published 2022-05-02 Modified 2024-02-08 Official page ↗
Aliases
CVE-2009-5054
Ecosystem
Packagist
Packages
smarty/smarty
Severity
Moderate
Weaknesses
CWE-281
Reviewed
2024-02-08

Affected packages

• Packagist smarty/smarty: < 3.0.0-beta4 → fixed in 3.0.0-beta4

Description

Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.

Related

Alias · CVE (1)

  • CVE-2009-5054 Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass… vulnerability

Weakness · CWE (1)

  • CWE-281 Improper Preservation of Permissions weakness

References