PT-2022-9201 · Smarty +2 · Smarty +2

🗓️ 10 Jan 2022 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 4 Views

Smarty template engine prior to 3.1.43 and 4.0.3 allows restricted static methods; update to 3.1.43 and 4.0.3.

Reporter	Title	Published	Views	Family All 189
GithubExploit	Exploit for Code Injection in Smarty	25 May 202206:02	–	githubexploit
BDU FSTEC	The vulnerability of PHP Smarty template handlers, related to improper code generation, allows attackers to execute arbitrary PHP code.	12 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of PHP Smarty template handlers relates to improper code generation during the processing of invalid function names, allowing attackers to execute arbitrary code.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of implementing a isolated programming environment for PHP Smarty’s template processors allows attackers to circumvent the restrictions of an isolated programming environment.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of PHP Smarty template handlers, related to defects in the array processing of trusted directories $trusted_dir, allows attackers to gain unauthorized access to protected information.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the implementation of the isTrustedResourceDir method in the Smarty_Security template handler for PHP Smarty allows a malicious actor to gain unauthorized access to protected information.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of PHP Smarty template handlers, related to improper code generation, allows attackers to execute arbitrary PHP code.	29 Jun 202200:00	–	bdu_fstec
Circl	CVE-2021-21408	10 Jan 202222:14	–	circl
Circl	CVE-2021-26119	19 Feb 202112:13	–	circl
Circl	CVE-2021-26120	19 Feb 202112:13	–	circl

Source	Link
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-21408.yaml
github	www.github.com/sbani/CVE-2022-29221-PoC
web	www.web.archive.org/web/20250000000000*/https:/github.com/Udyz/CVE-2021-26119
github	www.github.com/smarty-php/smarty/commit/19ae410bf56007a5ef24441cdc6414619cfaf664
bdu	www.bdu.fstec.ru/vul/2022-02203
osv	www.osv.dev/vulnerability/USN-5348-1
osv	www.osv.dev/vulnerability/DLA-2995-1
ubuntu	www.ubuntu.com/security/CVE-2021-26119
security-tracker	www.security-tracker.debian.org/tracker/source-package/smarty3
cve	www.cve.mitre.org/cgi-bin/cvename.cgi

08 Dec 2022 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.18.8 - 9.8

CVSS 27.5

CVSS 35.9

EPSS0.82316

SSVC