Cross site scripting vulnerability in Javascript escaping in smarty/smarty
Résumé
Cross site scripting vulnerability in Javascript escaping in smarty/smarty
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-28447 smarty3 Corrigé dans: 3.1.39-2+deb11u2
- Ubuntu UBUNTU-CVE-2023-28447 civicrm Corrigé dans: 4.7.1+dfsg-2ubuntu1+esm1
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org