PT-2021-6792 · Smarty+2 · Smarty+2

Published 2021-02-17 · Updated 2022-10-14 · CVE-2021-26119

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 3.1.39

Description The issue allows a Sandbox Escape because the $smarty.template object can be accessed in sandbox mode. This is due to insufficient access control when handling the $smarty.template object. Exploitation of this issue may allow a remote attacker to bypass sandbox restrictions.

Recommendations For versions prior to 3.1.39, upgrade to 3.1.39 or higher as soon as possible to prevent the bypassing of sandbox protection. As a temporary workaround, consider restricting access to the $smarty.template object until a patch is applied.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-264

CWE-269

Related Identifiers

BDU:2022-02201

CVE-2021-26119

DLA-2618-1

DLA-2618-2

DSA-5151-1

GHSA-W5HR-JM4J-9JVQ

MGASA-2021-0335

MGASA-2022-0127

USN-5348-1

USN-5348-2

USN-5348-3

Affected Products

Linuxmint

Smarty

Ubuntu

References · 49

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-26119.yaml · Exploit
• 🔥 https://github.com/sbani/CVE-2022-29221-PoC · Exploit
• 🔥❌ https://github.com/Udyz/CVE-2021-26119 · Exploit, Deleted
• https://ubuntu.com/security/CVE-2021-26120 · Vendor Advisory
• https://debian.org/security/2022/dsa-5151 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-13982 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2618-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-26119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26119 · Security Note
• https://osv.dev/vulnerability/DSA-5151-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0127 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2618-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26119 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26119 · Vendor Advisory
• https://debian.org/lts/security/2021/dla-2618 · Vendor Advisory