GHSA-2pmx-6mm6-6v72 — high GitHub Advisory (CVE-2014-8350) in composer/smarty/smarty

説明

Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.

基本情報

タイプ: reviewed
深刻度: high
GitHub 上のアドバイザリ: アドバイザリを開く ↗
リポジトリのアドバイザリ: —
ソースコード: ソースを見る ↗
公開（アドバイザリ）: 2022-05-17 01:13:38 UTC
更新: 2024-04-24 22:53:35 UTC
GitHub レビュー済み: 2024-04-24 22:53:34 UTC
NVD で公開: 2014-11-03

Score	Percentile
0.47%	64.52%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type	Value
GHSA	GHSA-2pmx-6mm6-6v72 ↗
CVE	CVE-2014-8350 ↗

CWEs

CWE id	Name
CWE-94	Improper Control of Generation of Code ('Code Injection')

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
composer	smarty/smarty	< 3.1.21	3.1.21	—

Smarty arbitrary PHP code execution

説明

基本情報

EPSS Score

CVSS Scores

Identifiers

CWEs

Affected packages (1)

References