PHP Code Injection by malicious block or filename in Smarty
Résumé
PHP Code Injection by malicious block or filename in Smarty
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-29221 smarty3 Corrigé dans: 3.1.39-2+deb11u1
- Ubuntu UBUNTU-CVE-2022-29221 collabtive
Références
- advisory github.com
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory debian.org
- patch github.com
- web github.com
- web github.com
- web lists.debian.org