Lucene search

[email protected]NVD:CVE-2014-8350

HistoryNov 03, 2014 - 4:55 p.m.

CVE-2014-8350

2014-11-0316:55:08

CWE-94

[email protected]

web.nvd.nist.gov

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.3 High

AI Score

Confidence

Low

0.048 Low

EPSS

Percentile

92.7%

JSON

Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by “{literal}<{/literal}script language=php>” in a template.

Affected configurations

NVD

Node

smartysmartyRange≤3.1.20

smartysmartyMatch1.0

smartysmartyMatch1.0a

smartysmartyMatch1.0b

smartysmartyMatch1.1.0

smartysmartyMatch1.2.0

smartysmartyMatch1.2.1

smartysmartyMatch1.2.2

smartysmartyMatch1.3.0

smartysmartyMatch1.3.1

smartysmartyMatch1.3.2

smartysmartyMatch1.4.0

smartysmartyMatch1.4.0b1

smartysmartyMatch1.4.0b2

smartysmartyMatch1.4.1

smartysmartyMatch1.4.2

smartysmartyMatch1.4.3

smartysmartyMatch1.4.4

smartysmartyMatch1.4.5

smartysmartyMatch1.4.6

smartysmartyMatch1.5.0

smartysmartyMatch1.5.1

smartysmartyMatch1.5.2

smartysmartyMatch2.0.0

smartysmartyMatch2.0.1

smartysmartyMatch2.1.0

smartysmartyMatch2.1.1

smartysmartyMatch2.2.0

smartysmartyMatch2.3.0

smartysmartyMatch2.3.1

smartysmartyMatch2.4.0

smartysmartyMatch2.4.1

smartysmartyMatch2.4.2

smartysmartyMatch2.5.0

smartysmartyMatch2.5.0rc1

smartysmartyMatch2.5.0rc2

smartysmartyMatch2.6.0

smartysmartyMatch2.6.0rc1

smartysmartyMatch2.6.0rc2

smartysmartyMatch2.6.0rc3

smartysmartyMatch2.6.1

smartysmartyMatch2.6.2

smartysmartyMatch2.6.3

smartysmartyMatch2.6.4

smartysmartyMatch2.6.5

smartysmartyMatch2.6.6

smartysmartyMatch2.6.7

smartysmartyMatch2.6.9

smartysmartyMatch2.6.10

smartysmartyMatch2.6.11

smartysmartyMatch2.6.12

smartysmartyMatch2.6.13

smartysmartyMatch2.6.14

smartysmartyMatch2.6.15

smartysmartyMatch2.6.16

smartysmartyMatch2.6.17

smartysmartyMatch2.6.18

smartysmartyMatch2.6.20

smartysmartyMatch2.6.22

smartysmartyMatch2.6.24

smartysmartyMatch2.6.25

smartysmartyMatch2.6.26

smartysmartyMatch3.0.0

smartysmartyMatch3.0.0beta4

smartysmartyMatch3.0.0beta5

smartysmartyMatch3.0.0beta6

smartysmartyMatch3.0.0beta7

smartysmartyMatch3.0.0beta8

smartysmartyMatch3.0.0rc1

smartysmartyMatch3.0.0rc2

smartysmartyMatch3.0.0rc3

smartysmartyMatch3.0.0rc4

smartysmartyMatch3.0.1

smartysmartyMatch3.0.2

smartysmartyMatch3.0.3

smartysmartyMatch3.0.4

smartysmartyMatch3.0.5

smartysmartyMatch3.0.6

smartysmartyMatch3.0.7

smartysmartyMatch3.1rc1

smartysmartyMatch3.1.0

smartysmartyMatch3.1.1

smartysmartyMatch3.1.2

smartysmartyMatch3.1.3

smartysmartyMatch3.1.4

smartysmartyMatch3.1.5

smartysmartyMatch3.1.6

smartysmartyMatch3.1.7

smartysmartyMatch3.1.8

smartysmartyMatch3.1.9

smartysmartyMatch3.1.10

smartysmartyMatch3.1.11

smartysmartyMatch3.1.12

smartysmartyMatch3.1.13

smartysmartyMatch3.1.14

smartysmartyMatch3.1.15

smartysmartyMatch3.1.16

smartysmartyMatch3.1.17

smartysmartyMatch3.1.18

smartysmartyMatch3.1.19

References

advisories.mageia.org/MGASA-2014-0468.html

seclists.org/oss-sec/2014/q4/420

seclists.org/oss-sec/2014/q4/421

www.mandriva.com/security/advisories?name=MDVSA-2014:221

www.securityfocus.com/bid/70708

bugs.debian.org/cgi-bin/bugreport.cgi?bug=765920

code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt?r=4902

exchange.xforce.ibmcloud.com/vulnerabilities/97725

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.3 High

AI Score

Confidence

Low

0.048 Low

EPSS

Percentile

92.7%

JSON

Related for NVD:CVE-2014-8350

nessus5 fedora3 ubuntucve1 debiancve1 osv2 cvelist1 prion1 openvas5 cve1 mageia2 debian1 github1 securityvulns2