PT-2021-6791 · Smarty +2 · Smarty +2

🗓️ 17 Feb 2021 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 3 Views

Vulnerability in Smarty versions before 3.1.39 allows remote code execution via invalid function names.

Reporter	Title	Published	Views	Family All 190
GithubExploit	Exploit for Code Injection in Smarty	25 May 202206:02	–	githubexploit
BDU FSTEC	The vulnerability of PHP Smarty template handlers, related to improper code generation, allows attackers to execute arbitrary PHP code.	12 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of PHP Smarty template handlers relates to improper code generation during the processing of invalid function names, allowing attackers to execute arbitrary code.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of implementing a isolated programming environment for PHP Smarty’s template processors allows attackers to circumvent the restrictions of an isolated programming environment.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of PHP Smarty template handlers, related to defects in the array processing of trusted directories $trusted_dir, allows attackers to gain unauthorized access to protected information.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the implementation of the isTrustedResourceDir method in the Smarty_Security template handler for PHP Smarty allows a malicious actor to gain unauthorized access to protected information.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of PHP Smarty template handlers, related to improper code generation, allows attackers to execute arbitrary PHP code.	29 Jun 202200:00	–	bdu_fstec
Circl	CVE-2021-21408	10 Jan 202222:14	–	circl
Circl	CVE-2021-26119	19 Feb 202112:13	–	circl
Circl	CVE-2021-26120	19 Feb 202112:13	–	circl

Source	Link
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-26120.yaml
github	www.github.com/sbani/CVE-2022-29221-PoC
web	www.web.archive.org/web/20250000000000*/https:/github.com/Udyz/CVE-2021-26119
bdu	www.bdu.fstec.ru/vul/2022-02203
osv	www.osv.dev/vulnerability/USN-5348-1
osv	www.osv.dev/vulnerability/CVE-2021-26120
debian	www.debian.org/lts/security/2021/dla-2618
ubuntu	www.ubuntu.com/security/CVE-2021-26119
security-tracker	www.security-tracker.debian.org/tracker/source-package/smarty3
cve	www.cve.mitre.org/cgi-bin/cvename.cgi

14 Oct 2022 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 27.5 - 10

CVSS 3.18.8 - 9.8

CVSS 35.9

EPSS0.7558

SSVC