PT-2022-12704 · Fenom · Fenom

Altm4 · Published 2022-03-28 · Updated 2022-04-04 · CVE-2021-46433

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fenom versions 2.12.1 and earlier

Description The issue allows bypassing the sandbox to execute arbitrary PHP code when disable native funcs is true. This is possible through the getTemplateCode() function in fenom/src/Fenom/Template.php.

Recommendations For Fenom versions 2.12.1 and earlier, as a temporary workaround, consider disabling the getTemplateCode() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-46433

GHSA-674V-3G2W-84GX

Affected Products

Fenom

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-46433 · Security Note
• https://osv.dev/vulnerability/GHSA-674v-3g2w-84gx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46433 · Vendor Advisory
• https://github.com/fenom-template/fenom · Note
• https://github.com/fenom-template/fenom/issues/331 · Note
• https://t.me/cvenotify/28424 · Telegram Post