PT-2022-9201 · Smarty+2 · Smarty+2

Highwisskid · Published 2022-01-10 · Updated 2022-12-08 · CVE-2021-21408

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 3.1.43 Smarty versions prior to 4.0.3

Description Smarty is a template engine for PHP that facilitates the separation of presentation from application logic. Template authors could run restricted static php methods prior to versions 3.1.43 and 4.0.3.

Recommendations For versions prior to 3.1.43, update to version 3.1.43 to receive the patch. For versions prior to 4.0.3, update to version 4.0.3 to receive the patch.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-21408

DLA-2995-1

DSA-5151-1

GHSA-4H9C-V5VG-5M6M

MGASA-2022-0127

USN-5348-1

USN-5348-2

USN-5348-3

Affected Products

Linuxmint

Smarty

Ubuntu

References · 45

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-21408.yaml · Exploit
• 🔥 https://github.com/sbani/CVE-2022-29221-PoC · Exploit
• 🔥❌ https://github.com/Udyz/CVE-2021-26119 · Exploit, Deleted
• https://github.com/smarty-php/smarty/commit/19ae410bf56007a5ef24441cdc6414619cfaf664 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-21408 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5348-2 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0127 · Vendor Advisory
• https://security.gentoo.org/glsa/202209-09 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI · Vendor Advisory
• https://debian.org/security/2022/dsa-5151 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5151-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16831 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21408 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21408 · Vendor Advisory