Back

CVE-2024-35226

May 28, 2024, 9:16 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Smarty

  • UNKNOWN

Source

security-advisories@github.com

Tags

security-advisories@github.com
CWE-94
2024-05-28
CVE-2024-35226

CVE-2024-35226 details

Published : May 28, 2024, 9:16 p.m.
Last Modified : May 28, 2024, 9:16 p.m.

Description

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.

CVSS Score

1 2 3 4 5 6 7.3 8 9 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

7.3

Exploitability Score

Impact Score

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

URL Source
https://github.com/smarty-php/smarty/commit/0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a security-advisories@github.com
https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w security-advisories@github.com
This website uses the NVD API, but is not approved or certified by it.