PT-2019-6613 · Smarty · Smarty3

Jan Lieskovsky · Publicado 2019-11-20 · Atualizado 2022-04-22 · CVE-2011-1028

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Smarty3 (affected versions not specified)

Description The issue allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty internal compile private special variable.php file. This is related to the $smarty.template variable in Smarty3.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-1028

GHSA-6FRX-2R5W-C524

Produtos afetados

Smarty3

Referências · 13

• https://github.com/smarty-php/smarty/commit/0154f17de2b2dd16ff9c016923015ac19af9c0cb · Nota
• https://github.com/smarty-php/smarty · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1028 · Nota
• https://access.redhat.com/security/cve/cve-2011-1028 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1028 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1028 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2011-1028 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-1028 · Aviso do Fabricante
• https://t.me/cibsecurity/8225 · Publicação no Telegram
• https://seclists.org/oss-sec/2011/q1/313 · Nota
• https://web.archive.org/web/20110609032516/http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt · Nota
• https://smarty.net/forums/viewtopic.php?t=18815 · Nota
• https://osv.dev/vulnerability/GHSA-6frx-2r5w-c524 · Aviso do Fabricante